20 matches found
CVE-2026-46368
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user...
EUVD-2026-31836
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user...
CVE-2026-46368
CVE-2026-46368 affects the OpenWrt luci-app-https-dns-proxy package (not Core OpenWrt). The vulnerability is a command injection in setInitAction via a ubus RPC call; an authenticated user with the luci.https-dns-proxy ACL can inject shell metacharacters through the 'name' parameter, enabling arb...
CVE-2026-46368
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user...
CVE-2026-46368 luci-app-https-dns-proxy Authenticated Command Injection via setInitAction
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user...
CVE-2026-46368 luci-app-https-dns-proxy Authenticated Command Injection via setInitAction
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user...
PT-2026-43259
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user...
CVE-2024-39208
luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials...
CVE-2024-39209
luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter...
CVE-2024-39209
luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter...
CVE-2024-39208
luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials...
CVE-2024-39208
CVE-2024-39208 affects luci-app-lucky v2.8.3 and stems from hardcoded credentials in the software. Public sources (NVD, Red Hat, CNNVD, CVE listing) assign a high impact with CVSS v3.1 base score 9.8 (Network attack, no user interaction, privileges NONE, scope UNCHANGED; Confidentiality/Integrity...
PT-2024-28388 · Unknown · Luci-App-Lucky
Name of the Vulnerable Software and Affected Versions: luci-app-lucky version 2.8.3 Description: The issue is related to hardcoded credentials in the software. Recommendations: For luci-app-lucky version 2.8.3, update to a version where the hardcoded credentials issue is resolved, if available. A...
CVE-2024-39209
luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter...
CVE-2024-39209
luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter...
CVE-2024-39208
luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials...
luci-app-lucky security vulnerability
luci-app-lucky is a LuCI application designed for OpenWrt firmware by the individual developer gdy666. A security vulnerability exists in luci-app-lucky version v2.8.3, which stems from the use of hard-coded credentials...
CVE-2024-39209
The CVE-2024-39209 entry concerns luci-app-sms-tool v1.9-6, which has a command injection vulnerability exploitable via the score parameter. The issue is documented across multiple feeds (NVD, Red Hat, CVE lists). Affected component: luci-app-sms-tool, version 1.9-6. Root cause: command injection...
CVE-2024-39208
luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials...
Security Advisory 2021-08-01-3 - luci-app-ddns: Multiple authenticated RCEs (CVE-2021-28961)
DESCRIPTION An authenticated user in LuCI is able to inject shell code in luci-app-ddns. Multiple variables in the luci-app-ddns applications where not validated before they were executed on the system's shell, which could be exploited by adding system shell commands. REQUIREMENTS To exploit this...