CVE-2018-18323

CVE-2018-18323 affects CentOS Web Panel 0.9.8.480. The vulnerability is a Local File Inclusion via directory traversal using the URI admin/index.php?module=file_editor&file=/../, enabling an attacker to read sensitive server files. The connected Nuclei template confirms LFI and notes additional i...

CVE-2018-18322

CVE-2018-18322 affects CentOS Web Panel version 0.9.8.480. The issue is a Command Injection in admin/index.php via shell metacharacters in the API parameters service_start, service_restart, service_fullstatus, or service_stop. Root cause: unsafely handling of those parameters enables injection th...

CVE-2018-5962

index.php in CentOS-WebPanel.com aka CWP CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpinieditor module or the emailaddress parameter to the mailadd-new module...

CVE-2018-5962

CVE-2018-5962 affects CentOS Web Panel (CWP) up to version v0.9.8.12 via XSS in index.php. The vulnerability is triggered by the id parameter in the phpini_editor module or the email_address parameter in the mail_add-new module, allowing cross-site scripting. Public sources in connected records c...

CVE-2018-5961

CVE-2018-5961 affects CentOS Web Panel up to v0.9.8.12, where an XSS vulnerability exists via the module parameter in the index.php file. The issue is described as a Cross-Site Scripting vulnerability (non-persistent) that can lead to script execution in a victim’s browser. Public details across ...