CVE-2024-53376

CVE-2024-53376 Injeção de Comandos do SO Autenticada no CyberPanel Dispositivos Afetados As versões do CyberPanel 2.3.8 são vulneráveis a uma injeção de comandos do SO. Para explorar a vulnerabilidade, o atacante precisa primeiro fazer login no painel web. Testado Com CyberPanel 2.3.7 Detalhes...

CVE-2024-51567

CVE-2024-51567 Exploit स्क्रिप्ट CVE-2024-51567 एक Python प्रूफ-ऑफ-कॉन्सेप्ट PoC एक्सप्लॉइट स्क्रिप्ट है जो CVE-2024-51567 के लिए है, जो CyberPanel v2.3.6 को प्रभावित करने वाली एक गंभीर कमांड इंजेक्शन भेद्यता है। upgrademysqlstatus एंडपॉइंट में पाई गई यह भेद्यता, CSRF सुरक्षा को बायपास करके और...

CVE-2024-51568---CyberPanel-Command-Injection-Nuclei-Template

CVE-2024-51568 - إثبات المفهوم لحقن الأوامر في CyberPanel بيئة إثبات مفهوم وقالب Nuclei لاختبار CVE-2024-51568، وهي ثغرة حقن أوامر حرجة قبل المصادقة في CyberPanel. تفاصيل الثغرة CVE: CVE-2024-51568 الشدة: حرجة CVSS 9.8 النوع: حقن أوامر قبل المصادقة نقطة النهاية: /filemanager/upload المعامل:...

CVE-2024-51378

CyberPanel कमांड इंजेक्शन भेद्यता - CVE-2024-51378 कमांड इंजेक्शन के माध्यम से CyberPanel Pre-Auth RCE रिमोट कोड एक्ज़ीक्यूशन के लिए एक्सप्लॉइट लेखक: Luka Petrovic refr4g खुलासा तिथि: अक्टूबर 2024 अवलोकन CyberPanel में कमांड इंजेक्शन भेद्यता CVE-2024-51378 के लिए proof-of-concept PoC एक्सप्लॉइट। ...

cyberpanel

🛠️ CyberPanel لوحة تحكم استضافة الويب مدعومة بـ OpenLiteSpeed، مصممة لتبسيط إدارة الاستضافة. 🔧 الميزات والخدمات 🔐 مستويات وصول مختلفة للمستخدمين عبر ACLs. 🌌 SSL تلقائي للمواقع الآمنة. 💻 خادم FTP لنقل الملفات. 🕒 خادم DNS خفيف الوزن PowerDNS. 🔐 phpMyAdmin لإدارة قواعد البيانات MariaDB. 📧 دعم البريد...

CVE-2024-51378

CVE-2024-51378 — ملخص، تخفيف، وتوثيق مستودع آمن ⚠️ تحذير أخلاقي وقانوني جميع المواد في هذا المستودع مخصصة فقط للأغراض التعليمية، والبحث الأمني المشروع، والاختبار في البيئات التي تمتلكها أو لديك إذن صريح بها. لا تقم بتشغيل هذه الأدوات أو البرامج النصية ضد أنظمة أطراف ثالثة دون إذن. القيام بالاستغلا...

CyberPanel - Command Injection

CyberPanel contains a command injection vulnerability in the /ftp/getresetstatus and /dns/getresetstatus endpoints.The vulnerability exists due to improper validation of the 'statusfile' parameter, which is directly used in a shell command.The security middleware only validates POST requests,...

CyberPanel - Command Injection

CyberPanel aka Cyber Panel before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner sink. There is /filemanager/upload aka File Manager upload unauthenticated remote code execution via shell metacharacters. id: CVE-2024-51568 info: name: CyberPanel - Comman...

CyberPanel v2.3.6 Pre-Auth Remote Code Execution

upgrademysqlstatus in databases/views.py in CyberPanel aka Cyber Panel before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware which is only for a POST request and using shell metacharacters in the...

CVE-2026-41473-CyberPanel-AI-Scanner-Unauth

CVE-2026-41473 — CyberPanel AI Scanner: وصول غير مصادق للقراءة/الكتابة عبر واجهة برمجة التطبيقات قالب كشف بأداة Nuclei لثغرة CVE-2026-41473 التي تؤثر على إصدارات CyberPanel الأقدم من 2.4.4. الثغرة تكشف ميزة AI Scanner في CyberPanel عن نقطتي نهاية لواجهة برمجة التطبيقات دون أي مصادقة:...

CyberPanel-RCE

CyberPanel-RCE Exploit pour la RCE de CyberPanel trouvée sur v2.3.6 Plus d'informations disponibles sur mon blog : https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce...

CVE-2024-51378

CVE-2024-51378 CVE-2024-51378 भेद्यता का विश्लेषण, कमजोर होस्टों को खोजने के लिए स्क्रिप्ट, एकल-थ्रेडेड और मल्टी-थ्रेडेड मोड में Python और nuclei पर एक्सप्लॉइट का उपयोग। स्क्रिप्ट का उपयोग केवल परीक्षण होस्टों पर शैक्षिक उद्देश्यों के लिए अनुमत है। 1-CVE-2024-51378.pdf - कार्य परिणामों के पाठ्य...

CVE-2026-41472-POC

CyberPanel XSS to RCE CVE-2026-41472 CyberPanel v2.4.3 में बिना प्रमाणीकरण वाले API एंडपॉइंट्स के माध्यम से एक-क्लिक रिमोट कोड निष्पादन। अवलोकन यह एक्सप्लॉइट CyberPanel की AI स्कैनर सुविधा में कई कमजोरियों को जोड़ता है: 1. बिना प्रमाणीकरण वाला डेटाबेस इंजेक्शन /api/ai-scanner/callback बिना...

CVE-2026-67613

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON reques...

CVE-2026-67614

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed...

EUVD-2026-58130

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON reques...

CVE-2026-67613 CyberPanel < 3.0.0 Path Traversal File Read via cloudAPI ReadReport

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON reques...

CVE-2026-67613

CyberPanel

CVE-2026-67614

CVE-2026-67614 affects CyberPanel prior to 3.0.0. A hard-coded JWT secret in the WebTerminal FastAPI SSH service allows unauthenticated remote attackers to forge valid tokens and obtain an interactive root shell via WebSocket on port 8888. An attacker can craft a forged JWT signed with the hardco...

CVE-2026-67614 CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed...