CVE-2024-5409: Saltos Rhinos

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php. An attacker could create a malicious URL and send it to a victim to obtain their session details.

Affected products

• Saltos Rhinos: version 3.0 only

Published 2024-05-27. Last modified 2026-06-17.