control-webpanel webpanel vulnerabilities and exploits

(subscribe to this query)

NA

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 prior to 0.9.8.1147 allows remote malicious users to execute arbitrary OS commands via shell metacharacters in the login parameter.

Control-webpanel Webpanel

5 Github repositories

NA

In CWP (aka Control Web Panel or CentOS Web Panel) prior to 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.

Control-webpanel Webpanel

NA

In CWP (aka Control Web Panel or CentOS Web Panel) prior to 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=gu...

Control-webpanel Webpanel

10

CVSSv2

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows malicious users to execute arbitrary code via a crafted POST request.

Control-webpanel Webpanel

4.3

CVSSv2

The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.

Control-webpanel Webpanel 0.9.8.1126

9

CVSSv2

Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.

Control-webpanel Webpanel 0.9.8.1126

10

CVSSv2

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.

Control-webpanel Webpanel -

10

CVSSv2

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.

Control-webpanel Webpanel -

10

CVSSv2

This vulnerability allows remote malicious users to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. Authentication is not required to exploit this vulnerability. The specific flaw exists within loader_ajax.php. When parsing the line paramet...

Control-webpanel Webpanel 0.9.8.891

10

CVSSv2

This vulnerability allows remote malicious users to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the domain...

Control-webpanel Webpanel 0.9.8.923

Get Started

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook