Skip to content
OpenAdvisories

Vendor

domoticz

4 known vulnerabilities.

Products

domoticz 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-75520

    Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

    Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lu…

    domoticz domoticz
  • Medium 4.4
    CVE-2026-11425

    Domoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device Rendering

    Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mob…

    domoticz domoticz
  • Medium 4.8
    CVE-2026-1001

    Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint

    Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary scripts by supplying crafted names con…

    domoticz domoticz