CVE-2021-45467

CWP (Control Web Panel / CentOS Web Panel) is affected by CVE-2021-45467 in versions before 0.9.8.1107. The issue is an unauthenticated null-byte (%00) injection in the scripts parameter of /user/loader.php (and /user/login.php) that can be exploited to register arbitrary API keys or access sensi...

The vulnerability of the ajax_mod_security.php implementation of the application for managing servers on CentOS Web Panel allows a hacker to execute arbitrary code.

The vulnerability of the ajaxmodsecurity.php implementation of the application for managing servers on CentOS Web Panel is related to the failure to take measures to eliminate special elements in the string entered by the user when processing the archivo parameter. Exploiting this vulnerability m...

The vulnerability of the server management application CentOS Web Panel lies in improper code generation, allowing attackers to execute arbitrary code.

The vulnerability of the CentOS Web Panel server management application is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created request...

CVE-2022-25047

The password reset token in CWP v0.9.8.1126 is generated using known or predictable values...

CVE-2022-25046

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...

CentOS Web Panel 0.9.8.1081 Cross Site Scripting

Exploit Title: CentOS Web Panel 0.9.8.1081 - Stored Cross-Site Scripting XSS Date: 13/08/2021 Exploit Author: Dinesh Mohanty Vendor Homepage: http://centos-webpanel.com Software Link: http://centos-webpanel.com Version: v0.9.8.1081 Tested on: CentOS 7 and 8 Description: Multiple Stored Cross Site...

CentOS Web Panel 0.9.8.1081 - Stored Cross-Site Scripting (XSS)

Exploit Title: CentOS Web Panel 0.9.8.1081 - Stored Cross-Site Scripting XSS Date: 13/08/2021 Exploit Author: Dinesh Mohanty Vendor Homepage: http://centos-webpanel.com Software Link: http://centos-webpanel.com Version: v0.9.8.1081 Tested on: CentOS 7 and 8 Description: Multiple Stored Cross Site...

CentOS Web Panel 0.9.8.1081 - Stored Cross-Site Scripting Vulnerability

Exploit Title: CentOS Web Panel 0.9.8.1081 - Stored Cross-Site Scripting XSS Exploit Author: Dinesh Mohanty Vendor Homepage: http://centos-webpanel.com Software Link: http://centos-webpanel.com Version: v0.9.8.1081 Tested on: CentOS 7 and 8 Description: Multiple Stored Cross Site Scripting Stored...

The vulnerability of the CentOS Web Panel application management application lies in its lack of protection for website structure elements, allowing attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the CentOS Web Panel administration application is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

CentOS Web Panel Command Injection Vulnerability

CentOS Web Panel CWP is a free web hosting control panel from the Control Web Panel community. A security vulnerability exists in CentOS Web Panel that originates in the Unprivileged User Portal section that is affected by a command injection vulnerability that can be exploited by an attacker to...

CVE-2021-31316

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter...

CVE-2021-31324

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution...

Command injection

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution...

CVE-2021-31316

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter...

Sql injection

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter...

CVE-2021-31324

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution...

CVE-2021-31316

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter...

CVE-2021-31324

CentOS Web Panel’s unprivileged User Portal is affected by a Command Injection vulnerability (CVE-2021-31324). The Nuclei templates describe exploitation via the idsession parameter, allowing unauthenticated attackers to execute arbitrary OS commands with root privileges, leading to full server c...

CVE-2021-31324

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution...

PT-2021-19242 · Unknown · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel affected versions not specified Description: The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection issue, which can lead to root Remote Code Execution. Recommendations: At the moment, there ...