Mgt-commerce Cloudpanel — known CVE vulnerabilities

Every CVE whose affected-product data names Mgt-commerce Cloudpanel, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2023-35885 — CVSS 9.8 (critical): CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
• CVE-2023-36630 — CVSS 8.8 (high): In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.
• CVE-2023-46157 — CVSS 8.8 (high): File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file…
• CVE-2024-24320 — CVSS 8.8 (high): Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information…
• CVE-2023-0391 — CVSS 8.1 (high): MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every…
• CVE-2023-33747 — CVSS 7.8 (high): CloudPanel v2.2.2 allows attackers to execute a path traversal.