Domoticz

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Domoticz records in CISA KEV

No Domoticz vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Domoticz 4 records MEDIUM Mydomoathome 1 record LOW

Records

4 records in Domoticz · all components

TI-2019-07959 CVE-2019-10664 · GHSA-vqvh-pxhj-fgc9

Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.

MEDIUM 53

Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08185 Published 2019-03-31 No fix listed CWE-89

TI-2019-07971 CVE-2019-10678 · GHSA-59gx-x7r4-97q5

Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.

MEDIUM 50

Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.1727 Published 2019-03-31 No fix listed CWE-93

TI-2019-11584 CVE-2019-15480 · GHSA-2595-5937-8f4h

Domoticz 4.10717 has XSS via item.Name.

LOW 26

Domoticz 4.10717 has XSS via item.Name.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00677 Published 2019-08-23 No fix listed CWE-79

TI-2026-00755 CVE-2026-1001 · GHSA-gc8q-hv36-8qpc

Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint

LOW 21

Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary…

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00198 Published 2026-03-25 Fixed in 2026.1 CWE-79

Open these records in search →

Critical	1
High	3
Medium	3
Low	1
No CVSS	0