CVE-2024-53376: Improper Neutralization of Special Elements used in an OS Command

CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI...

CyberPanel 安全漏洞

CyberPanel is a web hosting control panel with built-in DNS and email servers by the individual developer Usman Nasir. A security vulnerability exists in versions prior to CyberPanel f0cf648 that stems from allowing cross-site scripting attacks via token or username...

CyberPanel 安全漏洞

CyberPanel is a web hosting control panel with built-in DNS and email servers by Usman Nasir Personal Developer. A security vulnerability exists in CyberPanel versions prior to 2.3.8. An attacker can exploit this vulnerability to execute arbitrary commands against the website/submitWebsiteCreatio...

CVE-2024-56112

CyberPanel aka Cyber Panel before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php...

CVE-2024-56112

CyberPanel aka Cyber Panel before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php...

CVE-2024-56112

The CyberPanel web hosting control panel is vulnerable to Cross-Site Scripting (XSS) in versions prior to f0cf648 . The root cause is a lack of protective measures for the website structure, specifically allowing the improper neutralization of input via the token or username parameters in the plo...

Exploit for CVE-2024-53376

CVE-2024-53376 CyberPanel Authenticated OS Command Injection...

Metasploit Weekly Wrap-Up 12/13/2024

It’s raining RCEs! It's the second week of December and the weather forecast announced another storm of RCEs in Metasploit-Framework land. This weekly release includes RCEs for Moodle e-Learning platform, Primefaces, WordPress Really Simple SSL and CyberPanel along with two modules to change...

The vulnerability of the upgrademysqlstatus() function in the CyberPanel web hosting control panel allows a hacker to escalate their privileges and execute arbitrary commands.

The vulnerability of the upgrademysqlstatus function in the CyberPanel web hosting control panel is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to elevate their privileges and execute arbitrary commands remotely...

CVE-2024-54679

CyberPanel aka Cyber Panel before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions...

CISA Warns of Active Exploitation of Flaws in Zyxel, ProjectSend, and CyberPanel

The U.S. Cybersecurity and Infrastructure Security Agency CISA added multiple security flaws affecting products from Zyxel, North Grid Proself, ProjectSend, and CyberPanel to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The list of...

CVE-2024-54679

CyberPanel aka Cyber Panel before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions...

CVE-2024-54679

CyberPanel aka Cyber Panel before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions...

CyberPanel 安全漏洞

CyberPanel is a web hosting control panel with built-in DNS and email servers by Usman Nasir Personal Developer. A security vulnerability exists in CyberPanel aka Cyber Panel versions prior to 6778ad1, which stems from a restartMySQL operation that does not require the FilemanagerAdmin function...

CVE-2024-54679

CyberPanel (aka Cyber Panel) before the fix commit 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. The vulnerability arises because the restartMySQL operation is executed prior to ACL checks, allowing any authenticated user (low-privilege) to trigger a database ...

PT-2024-36402

Name of the Vulnerable Software and Affected Versions CyberPanel versions before 6778ad1 Description The issue concerns a lack of permission check for the FilemanagerAdmin capability when performing restart MySQL actions. This allows unauthorized access to restart MySQL without proper...

CVE-2024-54679

CyberPanel aka Cyber Panel before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions...

CVE-2024-54679

CyberPanel aka Cyber Panel before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions...

CVE-2024-54679: Missing Authorization

CyberPanel aka Cyber Panel before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-51378link is external CyberPanel Incorrect Default Permissions Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actor...