Vulnerabilities

TI-2026-00755 CVE-2026-1001 · GHSA-gc8q-hv36-8qpc

Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint

LOW 21

Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary…

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00198 Published 2026-03-25 Fixed in 2026.1 CWE-79

TI-2019-11584 CVE-2019-15480 · GHSA-2595-5937-8f4h

Domoticz 4.10717 has XSS via item.Name.

LOW 26

Domoticz 4.10717 has XSS via item.Name.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00677 Published 2019-08-23 No fix listed CWE-79

TI-2019-07971 CVE-2019-10678 · GHSA-59gx-x7r4-97q5

Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.

MEDIUM 50

Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.1727 Published 2019-03-31 No fix listed CWE-93

TI-2019-07959 CVE-2019-10664 · GHSA-vqvh-pxhj-fgc9

Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.

MEDIUM 53

Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08185 Published 2019-03-31 No fix listed CWE-89

Vulnerabilities

Filters

Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint

Domoticz 4.10717 has XSS via item.Name.

Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.

Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.