Domoticz

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Domoticz records in CISA KEV

No Domoticz vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Domoticz 4 records MEDIUM Mydomoathome 1 record LOW

Records

8 records

TI-2019-07959 CVE-2019-10664 · GHSA-vqvh-pxhj-fgc9

Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.

MEDIUM 53

Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08185 Published 2019-03-31 No fix listed CWE-89

TI-2019-07971 CVE-2019-10678 · GHSA-59gx-x7r4-97q5

Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.

MEDIUM 50

Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.1727 Published 2019-03-31 No fix listed CWE-93

TI-2020-14215 CVE-2020-21990 · GHSA-x5c3-r34h-xf45

Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by…

LOW 37

Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access control enforcement.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02329 Published 2021-04-29 No fix listed CWE-863

TI-2026-49933 CVE-2026-71265 · GHSA-fgwp-vhm9-7g5q

Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()

LOW 35

Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy…

CVSS 3.1HIGH 7.5 Adjacent network No auth No interaction EPSS 0.00286 Published 2026-08-05 No fix listed CWE-121

TI-2019-11584 CVE-2019-15480 · GHSA-2595-5937-8f4h

Domoticz 4.10717 has XSS via item.Name.

LOW 26

Domoticz 4.10717 has XSS via item.Name.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00677 Published 2019-08-23 No fix listed CWE-79

TI-2026-82248 CVE-2026-75520

Missing authorization and path traversal in Domoticz udevices command

LOW 24

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00279 Published 2026-10-28 No fix listed CWE-22

TI-2026-00755 CVE-2026-1001 · GHSA-gc8q-hv36-8qpc

Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint

LOW 21

Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary…

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00198 Published 2026-03-25 Fixed in 2026.1 CWE-79

TI-2026-09860 CVE-2026-11425 · GHSA-3f8p-349v-j5h8

Domoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device Rendering

LOW 10

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype…

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00252 Published 2026-08-07 Fixed in 2026.3 CWE-79

Open these records in search →

Critical	1
High	3
Medium	3
Low	1
No CVSS	0