CVE-2024-56112

CyberPanel aka Cyber Panel before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php...

CVE-2024-53376

CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI...

CVE-2024-53376

CyberPanel prior to 2.3.8 is affected by an authenticated OS command injection in the websites/submitWebsiteCreation endpoint. The root cause is input handling of the phpSelection field allowing shell metacharacters to be executed by an authenticated user, enabling arbitrary command execution wit...

CyberPanel 安全漏洞

CyberPanel is a web hosting control panel with built-in DNS and email servers by Usman Nasir Personal Developer. A security vulnerability exists in CyberPanel versions prior to 2.3.8. An attacker can exploit this vulnerability to execute arbitrary commands against the website/submitWebsiteCreatio...

CVE-2024-53376

CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI...

CyberPanel 安全漏洞

CyberPanel is a web hosting control panel with built-in DNS and email servers by the individual developer Usman Nasir. A security vulnerability exists in versions prior to CyberPanel f0cf648 that stems from allowing cross-site scripting attacks via token or username...

CVE-2024-56112

CyberPanel aka Cyber Panel before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php...

CVE-2024-56112

CyberPanel aka Cyber Panel before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php...

CVE-2024-56112

CVE-2024-56112 affects CyberPanel (Cyber Panel) prior to version f0cf648. The issue enables cross-site scripting (XSS) via crafted inputs in the token or username to the plogical/phpmyadminsignin.php endpoint. CVSSv3.1 base score 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); impact is limited to con...

Exploit for CVE-2024-53376

CVE-2024-53376 CyberPanel Authenticated OS Command Injection...

Metasploit Weekly Wrap-Up 12/13/2024

It’s raining RCEs! It's the second week of December and the weather forecast announced another storm of RCEs in Metasploit-Framework land. This weekly release includes RCEs for Moodle e-Learning platform, Primefaces, WordPress Really Simple SSL and CyberPanel along with two modules to change...

The vulnerability of the upgrademysqlstatus() function in the CyberPanel web hosting control panel allows a hacker to escalate their privileges and execute arbitrary commands.

The vulnerability of the upgrademysqlstatus function in the CyberPanel web hosting control panel is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to elevate their privileges and execute arbitrary commands remotely...

CyberPanel Multi CVE Pre-auth RCE

This module exploits three separate unauthenticated Remote Code Execution vulnerabilities in CyberPanel: - CVE-2024-51567: Command injection vulnerability in the "upgrademysqlstatus" endpoint. - CVE-2024-51568: Command Injection via the "completePath" parameter in the "outputExecutioner" sink. -...

CVE-2024-54679

CyberPanel aka Cyber Panel before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions...

CISA Warns of Active Exploitation of Flaws in Zyxel, ProjectSend, and CyberPanel

The U.S. Cybersecurity and Infrastructure Security Agency CISA added multiple security flaws affecting products from Zyxel, North Grid Proself, ProjectSend, and CyberPanel to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The list of...

CVE-2024-54679

CyberPanel aka Cyber Panel before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions...

CVE-2024-54679

CyberPanel (aka Cyber Panel) before the fix commit 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. The vulnerability arises because the restartMySQL operation is executed prior to ACL checks, allowing any authenticated user (low-privilege) to trigger a database ...

CyberPanel 安全漏洞

CyberPanel is a web hosting control panel with built-in DNS and email servers by Usman Nasir Personal Developer. A security vulnerability exists in CyberPanel aka Cyber Panel versions prior to 6778ad1, which stems from a restartMySQL operation that does not require the FilemanagerAdmin function...

CVE-2024-54679

CyberPanel aka Cyber Panel before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions...

PT-2024-36402 · Unknown · Cyberpanel

Name of the Vulnerable Software and Affected Versions: CyberPanel versions before 6778ad1 Description: The issue concerns a lack of permission check for the FilemanagerAdmin capability when performing restart MySQL actions. This allows unauthorized access to restart MySQL without proper...