251 matches found
CVE-2026-29812
CyberPanel versions prior to 2.4.4 lack logging for actions that could potentially manipulate the child domains list , reducing auditability of changes to that list. The vulnerability is scored CVSS 4.3 (Medium) with low integrity impact and no confidentiality or availability impact, requiring on...
CVE-2026-29811
CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...
CVE-2026-29810
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
CVE-2026-29810
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
CVE-2026-29811
CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...
CVE-2026-29810
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
PT-2026-90952
CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...
PT-2026-90949
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
PT-2026-90958
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...
CVE-2026-29812
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...
CVE-2026-29811
CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...
CVE-2026-29810
CyberPanel versions prior to 2.4.4 contain a business-logic flaw where a required return 0 statement is omitted, leading to an incomplete authorization or validation check. The vulnerability is exploitable over the network with low complexity and requires low privileges (an authenticated account)...
CVE-2026-29812
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...
CVE-2026-88895
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...
EUVD-2026-75445
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...
CVE-2026-88895 CyberPanel before 3.0.5 Authentication Bypass via API
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...
CVE-2026-88895
CyberPanel before 3.0.5 fails to enforce two-factor authentication (TOTP) on its API endpoints. Attackers who obtain an administrator's password can derive API tokens from that password and perform administrative operations or create authenticated sessions without the second factor. The vulnerabi...
CVE-2026-88895 CyberPanel before 3.0.5 Authentication Bypass via API
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...
PT-2026-89406
šØ CVE-2026-88895 CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or creat...
CVE-2026-88895: Improper Authentication
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated...