Maxum Rumpus vulnerabilities

A stored cross-site scripting (XSS) vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows attackers to inject malicious scripts via folder names. Insufficient input validation leads to persistent script storage on the server.

Maxum Rumpus 8.2.13 and 8.2.14 are affected by a command injection vulnerability. The user management functionality in the web administration panel contains a parameter that, due to insufficient validation, allows execution of arbitrary system commands.

A CSRF vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows an attacker to perform unintended actions in the web application if an authenticated user visits a malicious page.