- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 10 · 3 high, 2 medium
- Registry
- Packagist
Advisories 10
- CVE-2026-24788High 8.8
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability.
Affected: fixed in 3.3.6.
- CVE-2025-44163Medium 6.3
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php.
Affected: fixed in 3.3.6.
- CVE-2024-41637High 8.3
RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also…
Affected: through 3.1.4.
- CVE-2024-2497Medium 4.7
RaspAP raspap-webgui HTTP POST Request provider.php code injection
Affected: through 3.0.9.
- CVE-2024-28754High 7.5
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.
Affected: fixed in 3.1.0.
- CVE-2022-39987Unrated
A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via…
Affected: from 2.8.0, fixed in 2.9.5.
- CVE-2022-39986Unrated
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id…
Affected: from 2.8.0, fixed in 2.8.8.
- CVE-2023-30260Unrated
Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted…
Affected: fixed in 2.8.9.
- CVE-2021-38556Unrated
includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.
Affected: through 2.6.6.
- CVE-2021-38557Unrated
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.
Affected: through 2.6.6.