Filtered by vendor Control-webpanel
Subscriptions
Filtered by product Webpanel
Subscriptions
Total
80 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-18773 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | N/A |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password. | ||||
| CVE-2018-18774 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | N/A |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter. | ||||
| CVE-2018-18772 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | N/A |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command. | ||||
| CVE-2018-18322 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | N/A |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start, service_restart, service_fullstatus, or service_stop parameter. | ||||
| CVE-2018-18323 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | N/A |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&file=/../ URI. | ||||
| CVE-2018-18324 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | N/A |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start, service_fullstatus, service_restart, service_stop, or file (within the file_editor) parameter. | ||||
| CVE-2018-5962 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | N/A |
| index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address parameter to the mail_add-new module. | ||||
| CVE-2018-5961 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | N/A |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file. | ||||
| CVE-2019-16295 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 4.6 Medium |
| Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter. This can be exploited by a local attacker who supplies a crafted filename within a directory visited by the victim. | ||||
| CVE-2019-15235 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 6.5 Medium |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to gain access to the victim's password (for the OS and phpMyAdmin) via an attacker account. This is different from CVE-2019-14782. | ||||
| CVE-2019-14730 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 4.3 Medium |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a victim's account via an attacker account. | ||||
| CVE-2019-14723 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 4.3 Medium |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacker account. | ||||
| CVE-2019-14729 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 4.3 Medium |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a victim's account via an attacker account. | ||||
| CVE-2019-14726 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 5.4 Medium |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS records of a victim's account via an attacker account. | ||||
| CVE-2019-14721 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 6.5 Medium |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attacker account. | ||||
| CVE-2019-14782 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 6.5 Medium |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to make a request to extract the victim's password (for the OS and phpMyAdmin) via an attacker account. | ||||
| CVE-2019-14727 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 4.3 Medium |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password of a victim account via an attacker account. | ||||
| CVE-2019-14724 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 7.5 High |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a victim's account via an attacker account. | ||||
| CVE-2019-14728 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 4.3 Medium |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding destination to a victim's account via an attacker account. | ||||
| CVE-2019-14725 | 1 Control-webpanel | 1 Webpanel | 2024-08-05 | 4.3 Medium |
| In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker account. | ||||