Skip to content
OpenAdvisories

Package · Packagist

billz/raspap-webgui

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.8
    CVE-2026-24788

    RaspAP raspap-webgui contains an OS Command Injection vulnerability

    RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.

    RaspAP raspap-webgui billz/raspap-webgui Packagist
  • High 8.3
    CVE-2024-41637

    RaspAP allows an attacker to escalate privileges

    RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password.

    billz/raspap-webgui Packagist
  • High 7.5
    CVE-2024-28754

    raspap-webgui vulnerable to denial of service

    RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.

    billz/raspap-webgui Packagist
  • High 8.8
    CVE-2022-39987 EPSS 37%

    RaspAP Command Injection vulnerability

    A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php.

    billz/raspap-webgui Packagist
  • High 8.8
    CVE-2023-30260

    RaspAP raspap-webgui Command Injection vulnerability

    Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.

    billz/raspap-webgui Packagist
  • High 8.8
    CVE-2021-38556 EPSS 13%

    Command Injection in RaspAP 2.6.6

    includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.

    billz/raspap-webgui Packagist
  • High 8.8
    CVE-2021-38557

    raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.

    raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrit…

    billz/raspap-webgui Packagist