Vulnerability · Published Dec 9, 2025 · Assigned by VulnCheck
CVE-2021-47718OpenBMCS Directory Listing Information Disclosure
High 8.7
In plain English
A high-severity security flaw in OpenBMCS from OPEN BMCS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.5%top 54.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OpenBMCS 2.4 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive files by exploiting directory listing functionality. Attackers can browse directories like /debug/ and /php/ to discover configuration files, database credentials, and system information.
Affected products (as reported)
Weakness: CWE-548 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- ExploitDB-50671 exploit
- Official Product Homepage product
- Zero Science Lab Disclosure (ZSL-2022-5695) third-party-advisory
- VulnCheck Advisory: OpenBMCS Directory Listing Information Disclosure third-party-advisory