← Vulnerability feed

Vulnerability record · CVE-2019-10678 · published 31 March 2019

CVE-2019-10678: Domoticz vulnerability

Domoticz · Domoticz

Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.

7.5 CVSS 3.0 High EPSS 17% · top 3.0% CWE-93 · CWE-93
7.5CVSS 3.0 base score, v2 5.0
17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/152678/Domoticz-4.10577-Unauthenticated-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
https://github.com/domoticz/domoticz/commit/2119afbe74ee0c914c1d5c4c859c594c08b0ad42 PatchThird Party Advisory
https://www.exploit-db.com/exploits/46773/ ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/152678/Domoticz-4.10577-Unauthenticated-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
https://github.com/domoticz/domoticz/commit/2119afbe74ee0c914c1d5c4c859c594c08b0ad42 PatchThird Party Advisory
https://www.exploit-db.com/exploits/46773/ ExploitThird Party AdvisoryVDB Entry

Track CVE-2019-10678 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-10664Domoticz sql injection vulnerabilityDomoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.EPSS 8.2%5.4CVE-2019-15480Domoticz cross-site scripting vulnerabilityDomoticz 4.10717 has XSS via item.Name.EPSS 0.68%4.8CVE-2026-1001Domoticz cross-site scripting vulnerabilityDomoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality of the web …EPSS 0.19%7.5CVE-2025-61884Oracle E-Business Suite Configurator pre-auth data exposure flawOracle Configurator in Oracle E-Business Suite 12.2.3 through 12.2.14 exposes a vulnerability reachable over HTTP without authentication. A successfu…KEVEPSS 96%analysed

Source: NIST National Vulnerability Database (record CVE-2019-10678), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.