{"id":"CVE-2020-12259","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-12259","generatedAt":"2026-10-27T22:32:14.613Z","title":"rConfig 3.9.4 is vulnerable to reflected XSS.","description":"rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php.","published":"2020-05-18T13:15:11.000Z","lastModified":"2026-06-17T02:51:32.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["rconfig/rconfig"],"epss":{"score":0.96352,"percentile":0.99878,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 96.4%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-12259","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}