CVE-2020-10871

In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other more complex ways...

EUVD-2022-44628

Malicious code in bioql PyPI...

CVE-2022-41435

OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting XSS vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments...

CVE-2022-41435

OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting XSS vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments...

The vulnerability of the NAT Rules Name Screen web interface in the LuCI configuration interface allows a hacker to perform cross-site scripting attacks.

The vulnerability of the NAT Rules Name Screen web interface of the LuCI configuration interface in the embedded OpenWrt operating system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a remote attacker to perform cross-site...

CVE-2021-27821

The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability which can lead to attackers carrying out arbitrary code execution...

CVE-2021-33425

CVE-2021-33425 is a stored XSS in OpenWrt LuCI web interface (hostname change) affecting LuCI 19.07 series (19.07.0–19.07.7). The root cause is improper handling of the UCI hostname content in LuCI templates, allowing arbitrary JavaScript to be injected into the hostname field and reflected in th...

CVE-2021-27821

The CVE-2021-27821 entry concerns the Web Interface for OpenWrt LuCI (version 19.07 and earlier). It describes a cross-site scripting (XSS) vulnerability in the LuCI web interface that can lead to arbitrary code execution. Affected product/component: OpenWrt LuCI web interface up to v19.07. Under...

OpenWrt LuCI Input Validation Vulnerability

OpenWrt LuCI is a graphical configuration interface for OpenWrt. An input validation vulnerability exists in OpenWrt LuCI admin/status/realtime/bandwidthstatus and admin/status/realtime/wirelessstatus, which could be exploited by remote attackers to submit a special request that could execute...