Threats tagged 'ghsa-w675-v8gw-j298'

A command injection vulnerability exists in RaspAP raspap-webgui up to version 3.5.5 in the OpenVPN Configuration Handler component. The flaw is due to improper handling of the cfg_id argument in the escapeshellcmd function within ajax/openvpn/del_ovpncfg.php, allowing remote attackers to execute OS commands. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity). Public exploit details have been disclosed, but no vendor response or patch is currently available.