Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Control-webpanel Subscribe
Filtered by product Webpanel
Total 80 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-15429 1 Control-webpanel 1 Webpanel 2023-01-24 10.0 HIGH 9.8 CRITICAL
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_crons.php. When parsing the user parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9716.
CVE-2020-15426 1 Control-webpanel 1 Webpanel 2023-01-24 10.0 HIGH 9.8 CRITICAL
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_migration_cpanel.php. When parsing the serverip parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9709.
CVE-2020-15422 1 Control-webpanel 1 Webpanel 2023-01-24 10.0 HIGH 9.8 CRITICAL
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9731.
CVE-2020-10230 1 Control-webpanel 1 Webpanel 2023-01-24 7.5 HIGH 9.8 CRITICAL
CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php term parameter.
CVE-2019-15235 1 Control-webpanel 1 Webpanel 2023-01-24 4.0 MEDIUM 6.5 MEDIUM
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to gain access to the victim's password (for the OS and phpMyAdmin) via an attacker account. This is different from CVE-2019-14782.
CVE-2019-14782 1 Control-webpanel 1 Webpanel 2023-01-24 4.0 MEDIUM 6.5 MEDIUM
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to make a request to extract the victim's password (for the OS and phpMyAdmin) via an attacker account.
CVE-2019-14725 1 Control-webpanel 1 Webpanel 2023-01-24 4.0 MEDIUM 4.3 MEDIUM
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker account.
CVE-2019-14723 1 Control-webpanel 1 Webpanel 2023-01-24 4.0 MEDIUM 4.3 MEDIUM
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacker account.
CVE-2019-13476 1 Control-webpanel 1 Webpanel 2023-01-24 3.5 LOW 5.4 MEDIUM
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page.
CVE-2019-13599 1 Control-webpanel 1 Webpanel 2023-01-24 5.0 MEDIUM 5.3 MEDIUM
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times.
CVE-2019-13477 1 Control-webpanel 1 Webpanel 2023-01-24 4.3 MEDIUM 8.8 HIGH
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account.
CVE-2019-13359 1 Control-webpanel 1 Webpanel 2023-01-24 8.5 HIGH 7.5 HIGH
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.
CVE-2019-13360 1 Control-webpanel 1 Webpanel 2023-01-24 7.5 HIGH 9.8 CRITICAL
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.
CVE-2019-12190 1 Control-webpanel 1 Webpanel 2023-01-24 3.5 LOW 5.4 MEDIUM
XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter.
CVE-2019-11429 1 Control-webpanel 1 Webpanel 2023-01-24 3.5 LOW 4.8 MEDIUM
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on the "DNS Functions > "Add DNS Zone" screen.
CVE-2018-18774 1 Control-webpanel 1 Webpanel 2023-01-24 4.3 MEDIUM 6.1 MEDIUM
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter.
CVE-2018-18324 1 Control-webpanel 1 Webpanel 2023-01-24 4.3 MEDIUM 6.1 MEDIUM
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start, service_fullstatus, service_restart, service_stop, or file (within the file_editor) parameter.
CVE-2022-25046 1 Control-webpanel 1 Webpanel 2023-01-24 10.0 HIGH 9.8 CRITICAL
A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.
CVE-2022-25047 1 Control-webpanel 1 Webpanel 2023-01-24 4.3 MEDIUM 5.9 MEDIUM
The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.
CVE-2022-25048 1 Control-webpanel 1 Webpanel 2022-07-14 9.0 HIGH 8.8 HIGH
Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.