GCVE - cpe:2.3:a:raspap:raspap:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:raspap:raspap:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Raspap (`5831232f-10fa-554e-a59f-3a7e3ebbcc90`)
Product	Raspap (`cebfa0b7-52ff-5dc0-9c21-833bfb3435c0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/raspap/raspap-webgui`	purl2cpe	2026-06-01 10:13:29.430632

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-41637`	vulnerable	2026-06-08 06:43:54.784513	Details available RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password. Published: 2024-07-29T00:00:00.000Z Updated: 2024-08-02T04:46:52.565Z Open on db.gcve.eu Reference links https://github.com/RaspAP/raspap-webgui https://blog.0xzon.dev/2024-07-27-CVE-2024-41637/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-28754`	vulnerable	2026-06-08 06:33:27.195096	Details available RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request. Published: 2024-03-08T00:00:00.000Z Updated: 2024-11-01T19:10:08.646Z Open on db.gcve.eu Reference links https://dustri.org/b/carrot-disclosure.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-28753`	vulnerable	2026-06-08 06:33:27.194715	Details available RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request. Published: 2024-03-08T00:00:00.000Z Updated: 2024-11-14T19:38:57.940Z Open on db.gcve.eu Reference links https://dustri.org/b/carrot-disclosure.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-30260`	vulnerable	2026-06-08 06:02:43.955670	Details available Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form. Published: 2023-06-23T00:00:00.000Z Updated: 2024-12-05T17:01:02.651Z Open on db.gcve.eu Reference links https://eldstal.se/advisories/230328-raspap.html https://github.com/RaspAP/raspap-webgui/pull/1322	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-39987`	vulnerable	2026-06-08 05:47:19.004352	Details available A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey.php. Published: 2023-08-01T00:00:00.000Z Updated: 2024-10-21T13:51:48.803Z Open on db.gcve.eu Reference links https://github.com/RaspAP/raspap-webgui/blob/master/ajax/networking/get_wgkey.php https://medium.com/%40ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-39986`	vulnerable	2026-06-08 05:47:19.003918	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-33358`	vulnerable	2026-06-08 05:32:11.401678	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-33357`	vulnerable	2026-06-08 05:32:11.401339	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-33356`	vulnerable	2026-06-08 05:32:11.400924	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.