R-SOFT SERWIS vulnerabilities
We track 4 vulnerabilities in R-SOFT SERWIS products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 10, 2026.
Latest R-SOFT SERWIS vulnerabilities
- 9.0 Critical severity
DMS: Improper Neutralization of Special Elements used in an OS Command
R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current
- 8.2 High severity
DMS: Use of Weak Hash
R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file. This issue w
- 7.1 High severity
DMS: Authorization Bypass Through User-Controlled Key
R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any
- 8.7 High severity
DMS: Improper Neutralization of Special Elements used in an OS Command
R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with t