Control-webpanel Webpanel — known CVE vulnerabilities
Every CVE whose affected-product data names Control-webpanel Webpanel, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (85)
CVE-2020-15422 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2018-18322 — CVSS 9.8 (critical): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php…
CVE-2023-42121 — CVSS 9.8 (critical): Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute…
CVE-2022-25046 — CVSS 9.8 (critical): A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.
CVE-2021-45467 — CVSS 9.8 (critical): In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause…
CVE-2021-45466 — CVSS 9.8 (critical): In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to…
CVE-2021-31324 — CVSS 9.8 (critical): The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code…
CVE-2021-31316 — CVSS 9.8 (critical): The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.
CVE-2020-15623 — CVSS 9.8 (critical): This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15615 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2019-13360 — CVSS 9.8 (critical): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging…
CVE-2020-15614 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15613 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15612 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15611 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15610 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15608 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15607 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15606 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15435 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15434 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15433 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15432 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15431 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15430 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15429 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15428 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15427 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15426 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15425 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15424 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-15423 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2020-10230 — CVSS 9.8 (critical): CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php…
CVE-2020-15420 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891…
CVE-2020-15421 — CVSS 9.8 (critical): This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923…
CVE-2019-13477 — CVSS 8.8 (high): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password…
CVE-2023-42123 — CVSS 8.8 (high): Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
CVE-2019-13605 — CVSS 8.8 (high): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process…
CVE-2023-42120 — CVSS 8.8 (high): Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
CVE-2018-18772 — CVSS 8.8 (high): CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by…
CVE-2022-25048 — CVSS 8.8 (high): Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.
CVE-2018-18773 — CVSS 8.8 (high): CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by…
CVE-2023-42122 — CVSS 7.8 (high): Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate…
CVE-2018-18323 — CVSS 7.5 (high): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=fil…
CVE-2019-14724 — CVSS 7.5 (high): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding…
CVE-2019-13359 — CVSS 7.5 (high): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to…
CVE-2020-15616 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2020-15617 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2020-15618 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2020-15619 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2020-15620 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2020-15621 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2020-15622 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2020-15624 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2020-15625 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2020-15626 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2020-15627 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2020-15628 — CVSS 7.5 (high): This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel…
CVE-2019-15235 — CVSS 6.5 (medium): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/se…
CVE-2019-14782 — CVSS 6.5 (medium): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the…
CVE-2019-14721 — CVSS 6.5 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from…
CVE-2018-5961 — CVSS 6.1 (medium): CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file.
CVE-2018-18774 — CVSS 6.1 (medium): CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter.
CVE-2018-18324 — CVSS 6.1 (medium): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the…
CVE-2019-13387 — CVSS 6.1 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers…
CVE-2018-5962 — CVSS 6.1 (medium): index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or…
CVE-2019-14726 — CVSS 5.4 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS…
CVE-2019-12190 — CVSS 5.4 (medium): XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or…
CVE-2019-13476 — CVSS 5.4 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access…
CVE-2019-13383 — CVSS 5.3 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by…
CVE-2019-13599 — CVSS 5.3 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by…
CVE-2019-11429 — CVSS 4.8 (medium): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to…
CVE-2019-7646 — CVSS 4.8 (medium): CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via…
CVE-2019-16295 — CVSS 4.6 (medium): Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter. This can be…
CVE-2019-14727 — CVSS 4.3 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password…
CVE-2019-14725 — CVSS 4.3 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage…
CVE-2019-13385 — CVSS 4.3 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to…
CVE-2019-14730 — CVSS 4.3 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a…
CVE-2019-14722 — CVSS 4.3 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding…
CVE-2019-14723 — CVSS 4.3 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail…
CVE-2019-14728 — CVSS 4.3 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding…
CVE-2019-14729 — CVSS 4.3 (medium): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a…