Approved changes feed: RSS · Atom
cpe:2.3:a:domoticz:domoticz:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Domoticz (f9170198-04df-52ca-8765-bc7a41e2b073) |
|---|---|
| Product | Domoticz (28f8693e-afd7-5152-ac22-19de5ca35f2a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/domoticz/domoticz |
purl2cpe | 2026-06-01 10:16:24.676922 |
pkg:github/domoticz/domoticz |
purl2cpe | 2026-06-01 10:16:24.676925 |
pkg:rpm/fedora/domoticz |
purl2cpe | 2026-06-01 10:16:24.676928 |
pkg:rpm/opensuse/domoticz |
purl2cpe | 2026-06-01 10:16:24.676931 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-71265 |
vulnerable | 2026-09-16 04:32:59.295702 |
Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()
HIGH (7.5)
Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types).
Published: 2026-08-05T12:26:13.217Z
Updated: 2026-08-10T11:46:33.609Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11425 |
vulnerable | 2026-09-16 04:32:46.438141 |
Domoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device Rendering
MEDIUM (4.4)
Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover.
Published: 2026-08-07T20:20:09.402Z
Updated: 2026-08-17T16:18:03.176Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-1001 |
vulnerable | 2026-06-08 07:47:14.224099 |
Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint
Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web interface that allows authenticated administrators to execute arbitrary scripts by supplying crafted names containing script or HTML markup. Attackers can inject malicious code that is stored and rendered without proper output encoding, causing script execution in the browsers of users viewing the affected page and enabling unauthorized actions within their session context.
Published: 2026-03-25T18:12:52.519Z
Updated: 2026-07-14T15:53:02.684Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10678 |
vulnerable | 2026-06-08 05:12:24.897874 |
Details available
Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.
Published: 2019-03-31T20:53:54.000Z
Updated: 2024-08-04T22:32:01.204Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10664 |
vulnerable | 2026-06-08 05:12:24.887487 |
Details available
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
Published: 2019-03-31T13:14:17.000Z
Updated: 2024-08-04T22:32:01.239Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.