CVE-2024-51567

CVE-2024-51567 Exploit Script CVE-2024-51567 is a Python proof-of-concept PoC exploit script for CVE-2024-51567 , a critical command injection vulnerability affecting CyberPanel v2.3.6. This vulnerability, found in the upgrademysqlstatus endpoint, enables remote command execution RCE by bypassing...

CVE-2024-53376

CVE-2024-53376 CyberPanel Authenticated OS Command Injection Affected Devices CyberPanel versions 2.3.8 are vulnerable to an OS command injection. To exploit the vulnerability the attacker is required to firstly login to the webpanel. Tested With CyberPanel 2.3.7 Technical details An attacker can...

CVE-2024-51568---CyberPanel-Command-Injection-Nuclei-Template

CVE-2024-51568 - CyberPanel Command Injection PoC A proof-of-concept environment and Nuclei template for testing CVE-2024-51568, a critical pre-authentication command injection vulnerability in CyberPanel. Vulnerability Details CVE: CVE-2024-51568 Severity: Critical CVSS 9.8 Type:...

cyberpanel

🛠️ CyberPanel Panel de control de alojamiento web impulsado por OpenLiteSpeed, diseñado para simplificar la gestión del alojamiento. 🔧 Características y Servicios 🔐 Diferentes niveles de acceso de usuario mediante ACL. 🌌 SSL automático para sitios web seguros. 💻 Servidor FTP para transferencias de...

CVE-2024-51378

CyberPanel Command Injection Vulnerability - CVE-2024-51378 Exploit for CyberPanel Pre-Auth RCE Remote Code Execution via Command Injection Author: Luka Petrovic refr4g Date Disclosed: October 2024 Overview Proof-of-concept PoC exploit for a command injection vulnerability CVE-2024-51378 in...

CVE-2026-41472-POC

CyberPanel XSS a RCE CVE-2026-41472 Ejecución remota de código con un solo clic en CyberPanel v2.4.3 a través de endpoints de API no autenticados. Resumen Este exploit encadena múltiples vulnerabilidades en la función AI Scanner de CyberPanel: 1. Inyección de base de datos no autenticada...

CyberPanel 2.4.3-2.4.5 - AI Scanner Debug Disclosure

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

CVE-2026-29812

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...

CVE-2026-29811

CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...

CVE-2026-29810

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...

CyberPanel - Command Injection

CyberPanel aka Cyber Panel before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner sink. There is /filemanager/upload aka File Manager upload unauthenticated remote code execution via shell metacharacters. id: CVE-2024-51568 info: name: CyberPanel - Comman...

CyberPanel v2.3.6 Pre-Auth Remote Code Execution

upgrademysqlstatus in databases/views.py in CyberPanel aka Cyber Panel before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware which is only for a POST request and using shell metacharacters in the...

CyberPanel - Command Injection

CyberPanel contains a command injection vulnerability in the /ftp/getresetstatus and /dns/getresetstatus endpoints.The vulnerability exists due to improper validation of the 'statusfile' parameter, which is directly used in a shell command.The security middleware only validates POST requests,...

EUVD-2026-77076

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...

EUVD-2026-77075

CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...

EUVD-2026-77074

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...

CVE-2026-29812

CyberPanel versions prior to 2.4.4 lack logging for actions that could potentially manipulate the child domains list , reducing auditability of changes to that list. The vulnerability is scored CVSS 4.3 (Medium) with low integrity impact and no confidentiality or availability impact, requiring on...

CVE-2026-29811

CyberPanel versions prior to 2.4.4 are affected by a vulnerability in how the application detects an "alias" domain (a secondary domain serving the same content as a primary domain). The root cause is that this detection is performed via an ORM query filter rather than a Python if statement, whic...

CVE-2026-29810

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...

CVE-2026-29812

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...