12 matches found
CVE-2026-46368-OpenWrt-Exploit
OpenWrt luci-app-https-dns-proxy 经过身份验证的命令注入（CVE-2026-46368） 本仓库包含针对 luci-app-https-dns-proxy 中关键操作系统命令注入漏洞的概念验证（PoC）利用程序，该漏洞可导致以 root 身份执行任意命令。 CVE ID: CVE-2026-46368 Exploit-DB: EDB-52521 CVSS: 8.8（v3.1）/ 8.7（v4.0）— 高危 CWE: CWE-77（命令中对特殊元素处理不当） 漏洞详情 厂商: OpenWrt 社区包（维护者: mossdef-org / stangri） 产...
CVE-2026-26899
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...
CVE-2026-26899
The luci-app-https-dns-proxy component in OpenWrt PR #15 (prior to 2026-01-17) is vulnerable to arbitrary command execution. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy fails to properly neutralize shell metacharacters in the name parameter, allowing authenticated users t...
CVE-2026-26899: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...
CVE-2026-26899
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...
EUVD-2026-67101
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...
CVE-2026-26899
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...
CVE-2026-26899
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...
PT-2026-82517
Name of the Vulnerable Software and Affected Versions luci-app-https-dns-proxy versions prior to 2026-01-17 Description Authenticated users can execute arbitrary shell commands due to improper handling of shell metacharacters in the name parameter within the setInitAction function located in...
CVE-2026-67352: Improper Neutralization of Input During Web Page Generation
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...
CVE-2026-46368: Improper Neutralization of Special Elements used in a Command
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user...
