TI-2024-02323 CVE-2024-2497 · GHSA-99wg-vmvq-2cp5
RaspAP raspap-webgui HTTP POST Request provider.php code injection
Priority HIGH 65
A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical.
Vulnerabilities
12 records
TI-2024-18988 CVE-2024-28754 · GHSA-vc9f-mgxr-h32r
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent…
Priority MEDIUM 40
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.
TI-2024-18987 CVE-2024-28753 · GHSA-hxwf-g94w-jj52
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.
Priority LOW 30
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.
TI-2022-18934 CVE-2022-39987 · GHSA-7r88-wjhj-jr8m
A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated…
Priority HIGH 73
A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php.
TI-2022-18933 CVE-2022-39986 · GHSA-7c28-wg7r-pg6f
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated…
Priority CRITICAL 94
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php…
TI-2023-14196 CVE-2023-30260 · GHSA-hhqm-f4m4-pq39
Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote…
Priority MEDIUM 45
Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.
TI-2021-16152 CVE-2021-38556 · GHSA-7vph-p634-vrqf
includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.
Priority MEDIUM 53
includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.
TI-2021-16153 CVE-2021-38557 · GHSA-536p-4pcj-5mr9
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the…
Priority MEDIUM 42
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.
TI-2021-12822 CVE-2021-33358 · GHSA-j8xc-43rr-f4pf
Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and…
Priority MEDIUM 43
Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpa_passphrase" POST parameters in /hostapd, when the parameter values contain special characters such as ";" or "$()" which enables a…
TI-2021-12821 CVE-2021-33357 · GHSA-mm7c-32r5-jf4j
A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in…
Priority MEDIUM 59
A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated att…
TI-2021-12820 CVE-2021-33356 · GHSA-m85c-f3q8-mx62
Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an…
Priority MEDIUM 46
Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an authenticated remote attacker to inject arbitrary commands to /installers/common.sh component that can result in remote command executio…
TI-2020-15053 CVE-2020-24572 · GHSA-8q56-5gqm-7gq6
An issue was discovered in includes/webconsole.php in RaspAP 2.5.
Priority MEDIUM 48
An issue was discovered in includes/webconsole.php in RaspAP 2.5.