Vulnerabilities

TI-2026-65184 CVE-2026-101860 · GHSA-675c-v9h6-j3g3

RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management

HIGH 73

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00473 Published 2026-09-29 No fix listed CWE-266

TI-2026-65183 CVE-2026-101859 · GHSA-w675-v8gw-j298

RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection

MEDIUM 57

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01577 Published 2026-09-29 No fix listed CWE-77

TI-2026-65182 CVE-2026-101858 · GHSA-2wc9-fj5c-fjg2

RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection

MEDIUM 56

A flaw has been found in RaspAP raspap-webgui up to 3.5.5.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.02512 Published 2026-09-29 No fix listed CWE-77

TI-2026-19987 CVE-2026-24788 · GHSA-4wwf-f7w3-94f5

OS command injection in raspap-webgui

MEDIUM 42

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01351 Published 2026-02-02 Fixed in 3.3.6 CWE-78

TI-2025-32128 CVE-2025-50428 · GHSA-mqhg-76g5-3rxv

In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in…

HIGH 82

In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01626 Published 2025-08-27 No fix listed CWE-77

TI-2025-28599 CVE-2025-44163 · GHSA-277f-37gw-9gmq

RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in…

MEDIUM 61

RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00604 Published 2025-06-27 Fixed in 3.3.6 CWE-23

TI-2024-24354 CVE-2024-36622 · GHSA-2jfw-8cwj-3579

In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in…

MEDIUM 54

In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02838 Published 2024-11-29 No fix listed CWE-94

TI-2024-02323 CVE-2024-2497 · GHSA-99wg-vmvq-2cp5

RaspAP raspap-webgui HTTP POST Request provider.php code injection

HIGH 65

A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00907 Published 2024-03-15 No fix listed CWE-94

TI-2024-18988 CVE-2024-28754 · GHSA-vc9f-mgxr-h32r

RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent…

MEDIUM 40

RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00856 Published 2024-03-08 Fixed in 3.1.0

TI-2024-18987 CVE-2024-28753 · GHSA-hxwf-g94w-jj52

RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.

LOW 30

RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00689 Published 2024-03-08 No fix listed

TI-2022-18934 CVE-2022-39987 · GHSA-7r88-wjhj-jr8m

A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated…

HIGH 73

A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.37336 Published 2023-08-01 Fixed in 2.9.5 CWE-77

TI-2022-18933 CVE-2022-39986 · GHSA-7c28-wg7r-pg6f

A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated…

CRITICAL 94

A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99058 Published 2023-08-01 Fixed in 2.8.8 CWE-77

TI-2023-14196 CVE-2023-30260 · GHSA-hhqm-f4m4-pq39

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote…

MEDIUM 45

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02484 Published 2023-06-23 Fixed in 2.8.9 CWE-77

TI-2021-16152 CVE-2021-38556 · GHSA-7vph-p634-vrqf

includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.

MEDIUM 53

includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.13039 Published 2021-08-24 No fix listed CWE-77

TI-2021-16153 CVE-2021-38557 · GHSA-536p-4pcj-5mr9

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the…

MEDIUM 42

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02224 Published 2021-08-24 No fix listed CWE-732

TI-2021-12822 CVE-2021-33358 · GHSA-j8xc-43rr-f4pf

Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and…

MEDIUM 43

Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpa_passphrase" POST parameters in /hostapd, when the parameter values contain special characters such as ";" or "$()" which enables a…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02739 Published 2021-06-09 No fix listed CWE-78

TI-2021-12821 CVE-2021-33357 · GHSA-mm7c-32r5-jf4j

A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in…

MEDIUM 59

A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated att…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.17446 Published 2021-06-09 No fix listed CWE-78

TI-2021-12820 CVE-2021-33356 · GHSA-m85c-f3q8-mx62

Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an…

MEDIUM 46

Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an authenticated remote attacker to inject arbitrary commands to /installers/common.sh component that can result in remote command executio…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05347 Published 2021-06-09 No fix listed CWE-269

TI-2020-15053 CVE-2020-24572 · GHSA-8q56-5gqm-7gq6

An issue was discovered in includes/webconsole.php in RaspAP 2.5.

MEDIUM 48

An issue was discovered in includes/webconsole.php in RaspAP 2.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.06799 Published 2020-08-24 No fix listed CWE-78

Vulnerabilities

Filters