cve-2025-50428

CVE-2025-50428 - RaspAP 命令注入 CVE-2025-50428 的概念验证漏洞利用程序，针对 RaspAP raspap-webgui 3.2.9 及更早版本中的命令注入漏洞。 漏洞 ID| CVE-2025-50428 ---|--- 严重性| 高 CVSS 3.1: 8.6 CVSS 向量| CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 漏洞类型| 代码注入 攻击向量| 远程（已认证） 所需权限| 低 影响| 代码执行、权限提升 受影响产品| raspap-webgui ≤...

CVE-2020-24572-POC

CVE-2020-24572-POC 在RaspAP 2.5的includes/webconsole.php中发现了一个问题。通过认证访问，攻击者可以利用一个配置错误（且几乎不受限制）的Web控制台来攻击运行该软件的基础操作系统，并在系统上执行命令，包括上传文件和执行代码。 这是 https://github.com/lb0x/cve-2020-24572 的重制版。 如果你想使用原版，请点击他们的链接。 我添加了有效载荷选项，并且没有将利用限制为期望拥有执行 /etc/raspap/lighttpd/configport.sh 的sudo权限。 我认为任何人都可以执行 sudo -l...

RaspAP <=2.6.5 - Remote Command Injection

RaspAP 2.6 to 2.6.5 allows unauthenticated attackers to execute arbitrary OS commands via the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";". id: CVE-2021-33357 info: name: RaspAP =2.6.5 - Remote Command Injection...

cve-2020-24572

CVE-2020-24572 在 RaspAP 2.5 的 includes/webconsole.php 中发现了一个问题。攻击者可借助经过身份验证的访问，利用配置错误（且几乎不受限制）的 Web 控制台来攻击运行此软件的基础操作系统，并在系统上执行命令，包括上传文件和执行代码的命令。...

CVE-2022-39986-RaspAP-2.8.0-2.8.7-RCE

RaspAP Hunter RaspAP Hunter 是一个 Bash 脚本，用于扫描 RaspAP 安装并测试特定漏洞 CVE-2022-39986。 root@kitploit: / \ / | / \ / // // // // \ / /| | / // / / , // // / / // // | / / // || ,//// ./// ||// // author: mind2hex / / / / / / / // // / / // \ / // \ / / / // // // / / // / / // / // // ,/// // / ///...

RaspAP 2.8.7 - Unauthenticated Command Injection

A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfgid parameter in /ajax/openvpn/activateovpncfg.php and /ajax/openvpn/delovpncfg.php. id: CVE-2022-39986 info: name: RaspAP 2.8.7 - Unauthenticated Command Injectio...

CVE-2026-24788

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

RaspAP raspap-webgui contains an OS Command Injection vulnerability

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS Command Injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

GHSA-4WWF-F7W3-94F5 RaspAP raspap-webgui contains an OS Command Injection vulnerability

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS Command Injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

OS command injection in raspap-webgui

Overview RaspAP raspap-webgui contains the following vulnerability. OS command injection CWE-78 - CVE-2026-24788 Taihei Kusayanagi of NTT Security Japan KK reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

CVE-2026-24788

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

CVE-2026-24788

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

CVE-2026-24788

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

CVE-2026-24788

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

CVE-2026-24788

CVE-2026-24788 concerns RaspAP raspap-webgui prior to version 3.3.6, which is affected by an OS command injection vulnerability. Multiple connected sources (Red Hat's advisory RH:CVE-2026-24788, NVD/NVD-derived entries, GHSA entry, CIRCL sighting) corroborate that an authenticated user (login to ...

EUVD-2026-5116

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

raspap-webgui 操作系统命令注入漏洞

Raspap-webgui is an open-source wireless router configuration software developed by RaspAP. Versions of raspap-webgui prior to 3.3.6 contained a vulnerability related to operating system command injection. This vulnerability was due to the susceptibility to OS command injection attacks, which cou...

PT-2026-5604

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

PT-2026-6364

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS Command Injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

CVE-2021-33358

Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpapassphrase" POST parameters in /hostapd, when the parameter values contain special characters such as ";" or "$" which enables an authenticated attacker to execute arbitrary OS commands...