CVE-2020-10808

Vesta Control Panel VestaCP through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bashlogout to a .bashlogout' substring followed by shell...

Command injection

Vesta Control Panel VestaCP through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bashlogout to a .bashlogout' substring followed by shell...

CVE-2020-10808

CVE-2020-10808 affects Vesta Control Panel (VestaCP) up to version 0.9.8-26. It describes a command injection vulnerability in the schedule/backup Backup Listing Endpoint. The attacker must create a crafted filename on the server, demonstrated via an FTP session that renames a file (e.g., .bash_l...

CVE-2020-10808

Vesta Control Panel VestaCP through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bashlogout to a .bashlogout' substring followed by shell...

PT-2020-12337 · Vestacp · Vesta Control Panel

Name of the Vulnerable Software and Affected Versions: Vesta Control Panel VestaCP versions 0.9.8-26 and earlier Description: The issue allows Command Injection via the "schedule/backup Backup Listing Endpoint". An attacker must be able to create a crafted filename on the server. This can be...

NVIDIA Windows GPU Display Driver (Feb 2020)

A display driver installed on the remote Windows host is affected by multiple vulnerabilities. - A privilege escalation vulnerability exists in NVIDIA Control Panel component. An unauthenticated, local attacker can exploit this, via corrputing a system file, to gain priviledged access to the...

Subrion CMS CSRF Vulnerability

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. A cross-site request forgery vulnerability exists in Subrion CMS version 4.1.5 previous versions may also be affected....

Cross-Site Scripting (XSS)

Opencart is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize the filename argument in the image upload section of admin panel, allowing an attacker to inject malicious script and get the script executed when a user visits the Image manager section...

cPanel Remote Code Execution Vulnerability (CNVD-2020-18555)

cPanel is a set of Web-based host control management system of the U.S. cPanel. A remote code execution vulnerability exists in cPanel versions prior to 84.0.20. The vulnerability can be exploited to achieve remote code execution via the cpsrvd rsync shell using a demo account...

cPanel Authentication Bypass Vulnerability

cPanel is a set of Web-based host control management system of the U.S. cPanel. An authentication bypass vulnerability exists in cPanel versions prior to 82.0.18. The vulnerability stems from improper parsing of the password file format. An attacker can exploit this vulnerability to achieve...

Vesta Control Panel Authenticated Remote Code Execution

This module exploits an authenticated command injection vulnerability in the v-list-user-backups bash script file in Vesta Control Panel to gain remote code execution as the root user. Module Options msf use exploit/linux/http/vestacp/exec msf undefinedexec show actions ...actions... msf...

CentOS Web Panel SQL Injection Vulnerability

CentOS Web Panel CWP is a free web-hosting control panel that makes it easy to manage multiple servers without having to access the server via SSH for every little task that needs to be done. A SQL injection vulnerability exists in CentOS Web Panel. The vulnerability can be exploited to conduct S...

CVE-2020-10230

CentOS-WebPanel.com aka CWP CentOS Web Panel for CentOS 6 and 7 allows SQL Injection via the /cwpSESSIONHASH/admin/loaderajax.php term parameter...

CVE-2020-10230

CVE-2020-10230 affects CentOS Web Panel (CWP) for CentOS 6/7. The vulnerability is an SQL injection in loader_ajax.php via the term parameter (cwp_{SESSION_HASH}/admin/loader_ajax.php?term=...). Exploit details are available in Exploit-DB (and PT/Red Hat/CVEs reference the issue). No official pat...

PT-2020-11987 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions for CentOS 6 and 7 Description: The issue allows SQL Injection via the "/cwp SESSION HASH/admin/loader ajax.php" API endpoint, specifically through the term parameter. This enables potential attackers to inject...

CVE-2020-10500

CSRF in admin/reply-ticket.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to reply to any ticket, given the id, via a crafted request...

CVE-2020-10483

CSRF in admin/ajax-hub.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to post a comment on any article via a crafted request...

CVE-2020-10480

CSRF in admin/add-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new category via a crafted request...

CVE-2020-10457

Path Traversal in admin/imagepaster/image-renaming.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to rename any file on the webserver using a dot-dot-slash sequence ../ via the POST parameter imgName for the new name and imgUrl for the current file to be renamed...

CVE-2020-10421

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-departments.php by adding a question mark ? followed by the payload...