Skip to content
OpenAdvisories

Vendor

rathena

8 known vulnerabilities.

Products

rathena 4 FluxCP 4
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.6
    CVE-2025-62797

    CSRF in FluxCP account endpoints allows account takeover / state-changing actions

    FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept brow…

    rathena FluxCP
  • High 7.5
    CVE-2025-62170

    rAthena map-server use-after-free vulnerability in RODEX

    rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific att…

    rathena rathena
  • High 8.2
    CVE-2025-58750

    rAthena missing bound check in chclif_parse_moveCharSlot

    rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input…

    rathena rathena
  • High 7.3
    CVE-2024-45799

    Javascript Injection in Vending Info/Buyers Info Module in FluxCP

    FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser ju…

    rathena FluxCP