Jo-Philipp Wich

13 exploits Active since Oct 2019
CVE-2023-24182 WRITEUP MEDIUM WRITEUP
OpenWrt LuCI 22.03 - Stored Cross-Site Scripting in SSH Keys Management
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /system/sshkeys.js.
CVSS 5.4
CVE-2023-24181 WRITEUP MEDIUM WRITEUP
LuCI openwrt-22.03 branch git-22.361.69894-438c598 - Reflected Cross-Site Scripting via /openvpn/pageswitch.htm
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.
CVSS 5.4
CVE-2023-24182 WRITEUP MEDIUM WRITEUP
OpenWrt LuCI 22.03 - Stored Cross-Site Scripting in SSH Keys Management
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /system/sshkeys.js.
CVSS 5.4
CVE-2025-57389 WRITEUP MEDIUM WRITEUP
Luci OpenWRT v18.06.2 - Reflected Cross-Site Scripting via /admin/system/packages Endpoint
A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload. This vulnerability was fixed in OpenWRT v19.07.0.
CVSS 5.4
CVE-2019-17367 WRITEUP HIGH WRITEUP
OpenWRT 18.06.4 - Cross-Site Request Forgery via Network Configuration Endpoints
OpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless/radio1.network1, firewall, firewall/zones, firewall/forwards, firewall/rules, network/wan, network/wan6, or network/lan under /cgi-bin/luci/admin/network/.
CVSS 8.8
CVE-2019-18992 WRITEUP MEDIUM WRITEUP
OpenWrt 18.06.4 - Stored Cross-Site Scripting via Firewall Rule Name Fields
OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" (this can occur, for example, on a TP-Link Archer C7 device).
CVSS 5.4
CVE-2019-18993 WRITEUP MEDIUM WRITEUP
OpenWrt 18.06.4 - Stored Cross-Site Scripting via New Port Forward Name Field
OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI (this can occur, for example, on a TP-Link Archer C7 device).
CVSS 5.4
CVE-2019-25015 WRITEUP MEDIUM WRITEUP
OpenWrt 18.06.0-18.06.4 - Stored Cross-Site Scripting via SSID
LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID.
CVSS 5.4
CVE-2021-28961 WRITEUP HIGH WRITEUP
OpenWrt 19.07 - Authenticated OS Command Injection via DDNS POST Request
applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests.
CVSS 8.8
CVE-2022-41435 WRITEUP MEDIUM WRITEUP
OpenWRT LuCI <git-22.140.66206-02913be - XSS
OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments.
CVSS 5.4
CVE-2023-24181 WRITEUP MEDIUM WRITEUP
LuCI openwrt-22.03 branch git-22.361.69894-438c598 - Reflected Cross-Site Scripting via /openvpn/pageswitch.htm
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.
CVSS 5.4
CVE-2023-24182 WRITEUP MEDIUM WRITEUP
OpenWrt LuCI 22.03 - Stored Cross-Site Scripting in SSH Keys Management
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /system/sshkeys.js.
CVSS 5.4
CVE-2023-3085 WRITEUP LOW WRITEUP
X-WRT luci <22.10_b202303061504 - XSS
A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the function run_action of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipulation of the argument request_path leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 22.10_b202303121313 is able to address this issue. The patch is named 24d7da2416b9ab246825c33c213fe939a89b369c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230663.
CVSS 3.5