Vulnerability · CVE-2020-10220

rConfig rConfig Improper Neutralization of Special Elements used in an SQL Command

Q: Which versions are affected?

Compare what you have installed with <= 3.9.4. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Q: What should an analyst verify?

CWE-89: SQL Injection. EPSS 99.70%. The CISA KEV listing is the exploitation evidence. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.

Published Mar 7, 2020 · catalog updated Nov 1, 2026 · rConfig rConfig

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Patch now

CVE-2020-10220 is in the CISA known-exploited catalog. Confirm rConfig rConfig against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Same product and reporting

CVE-2020-13638 · Unknown · known exploited
CVE-2020-10548 · Unknown · known exploited
CVE-2020-10546 · Unknown · known exploited
CVE-2019-19509 · Unknown · known exploited
CVE-2020-10221 · High · known exploited

Severity: Critical9.8
Known exploitation: CISA KEV and VulnCheck KEV
EPSS: 99.70%
Remediation: Remediation guidance
Affected products: cpe rconfig/rconfig · vendor rConfig rConfig

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. VulnCheck canary evidence.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

cpe rconfig/rconfig<= 3.9.4
vendor rConfig rConfigversion unspecified

How to fix CVE-2020-10220

Vendor action
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Version check
Affected <= 3.9.4
Advisory
Open the cve_org record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2020-10220 is in the CISA known-exploited catalog. Confirm rConfig rConfig against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with <= 3.9.4. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

What should an analyst verify?

CWE-89: SQL Injection. EPSS 99.70%. The CISA KEV listing is the exploitation evidence. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Repository · github.com

Timeline

Detection, updates, and resolution for this record.

Nov 1, 2026 · VulnCheck KEV
Detected
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. VulnCheck canary evidence.
Nov 1, 2026 · CISA KEV
Known exploited
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Sources

CVE.orgVulnerability recordCVE-2020-10220
Official CVE identifier
cve.org
Metasploit ModulesPublic exploit moduleexploit_linux/http/rconfig_ajaxarchivefiles_rce
Public module reference (good). Module source is not copied into this catalog.
rapid7.com
NIST NVDVulnerability recordCVE-2020-10220
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.
nvd.nist.gov
Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/156688/rConfig-3.9-SQL-Injection.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com
VulnCheck KEVConfirmed exploitationCVE-2020-10220
An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.
vulncheck.com

References

Freshness

Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

Metasploit ModulesNov 6, 2026
Packet Storm SecurityNov 6, 2026
Packet Storm SecurityNov 6, 2026
Packet Storm SecurityNov 6, 2026
VulnCheck KEVNov 4, 2026
CVE.orgNov 2, 2026
NIST NVDNov 1, 2026

Priority score

75/100

Evidence confidence: Very high

CISA lists this vulnerability as known to be exploited.

Confirmed exploitation30/30
EPSS probability20/20
CVSS severity15/15
Public exploit10/10
Internet exposure0/10
Product prevalence0/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Critical

CVSS severity
9.8 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS probability
99.70% · p99.95%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
Yes · CISA KEV and VulnCheck KEV
CISA KEV since Nov 1, 2026. Ransomware use: Unknown.
Patch availability
Remediation guidance
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Weakness

CWE-89
SQL Injection
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.