Skip to content
Noroxi

RaspAP records

16 published records for vendor raspap.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 6.3%
Pre-auth RCE
4
With a fix record
31.3%
Median publish → KEV
No record has entered KEV

Records by year

  1. 20
  2. 21
  3. 23
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

16 records
  • CVE-2022-39986
    69This week

    A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id p

    CriticalCVSS 9.8WeaponizedEPSS 99%

    raspap · raspapAug 1, 2023

  • CVE-2022-39987
    46Plan

    A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via t

    HighCVSS 8.8No exploitEPSS 37%

    raspap · raspapAug 1, 2023

  • CVE-2021-33357
    44Plan

    A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the "iface" parameter va

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    raspap · raspapJun 9, 2021

  • CVE-2024-36622
    40Plan

    In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script.

    CriticalCVSS 9.8No exploitEPSS 2%

    raspap · raspap-webguiNov 29, 2024

  • CVE-2021-38556
    39Monitor

    includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.

    HighCVSS 8.8No exploitEPSS 13%

    raspap · raspapAug 24, 2021

  • CVE-2025-50428
    39Monitor

    In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    raspap · raspap-webguiAug 27, 2025

  • CVE-2020-24572
    37Monitor

    An issue was discovered in includes/webconsole.php in RaspAP 2.5.

    HighCVSS 8.8Proof of conceptEPSS 6%

    raspap · raspapAug 24, 2020

  • CVE-2021-33356
    37Monitor

    Multiple privilege escalation vulnerabilities in RaspAP 1.5 to 2.6.5 could allow an authenticated remote attacker to inject arbitrary comman

    HighCVSS 8.8No exploitEPSS 5%

    raspap · raspapJun 9, 2021

  • CVE-2021-33358
    36Monitor

    Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpa_passphrase" POST parameters in /hostapd, when the

    HighCVSS 8.8No exploitEPSS 2%

    raspap · raspapJun 9, 2021

  • CVE-2023-30260
    36Monitor

    Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST

    HighCVSS 8.8No exploitEPSS 2%

    raspap · raspapJun 23, 2023

  • CVE-2021-38557
    36Monitor

    raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.

    HighCVSS 8.8No exploitEPSS 2%

    raspap · raspapAug 24, 2021

  • CVE-2024-41637
    33Monitor

    RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also posse

    HighCVSS 8.3No exploitEPSS 0%

    Jul 29, 2024

  • CVE-2024-28754
    30Monitor

    RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.

    HighCVSS 7.5No exploitEPSS 0%

    raspap · raspapMar 8, 2024

  • CVE-2024-2497
    28Monitor

    RaspAP raspap-webgui HTTP POST Request provider.php code injection

    HighCVSS 7.2No exploitEPSS 0%

    raspap · raspapMar 15, 2024

  • CVE-2024-28753
    26Monitor

    RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.

    MediumCVSS 6.5No exploitEPSS 0%

    raspap · raspapMar 8, 2024

  • CVE-2025-44163
    25Monitor

    RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php.

    MediumCVSS 6.3No exploitEPSS 0%

    raspap · raspap-webguiJun 27, 2025