CVE-2019-12792: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root...

CVE-2019-12791: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root via the password reset form...

PT-2019-12945

Name of the Vulnerable Software and Affected Versions Vesta Control Panel version 0.9.8-24 Description A directory traversal issue in the v-list-user script allows remote attackers to escalate privileges from regular registered users to root via the password reset form. Recommendations For Vesta...

CVE-2019-9841

Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL...

Cross site scripting

Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL...

CVE-2019-9841

Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL...

CVE-2019-9841

Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL...

CVE-2019-9841

Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL...

CVE-2019-9841

CVE-2019-9841 affects Vesta Control Panel 0.9.8-23 and is a reflected/URL-based cross-site scripting vulnerability disclosed by multiple sources (NVD, OSV, CVE List). The issue is triggered by a crafted URL that leads to XSS in the product’s web interface (notably via the file-manager API per lin...

PT-2019-19889

Name of the Vulnerable Software and Affected Versions Vesta Control Panel version 0.9.8-23 Description The issue allows for cross-site scripting XSS attacks through a crafted URL. Recommendations For Vesta Control Panel version 0.9.8-23, update to a newer version that contains a fix for this issu...

CVE-2019-9841: Improper Neutralization of Input During Web Page Generation

Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL...

CVE-2018-1000884

Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Password reset code -- web/reset/index.php, line 51 that can result in Possible to determine password...

CVE-2018-18547

Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dira parameter, or the filename to the list/directory/ URI...

CVE-2018-18547

Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dira parameter, or the filename to the list/directory/ URI...

Design/Logic Flaw

Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dira parameter, or the filename to the list/directory/ URI...

CVE-2018-18547

Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dira parameter, or the filename to the list/directory/ URI...

CVE-2018-18547

Vesta Control Panel (VestaCP) up to version 0.9.8-22 is affected by a cross-site scripting (XSS) vulnerability. The issue arises from unsanitized input in multiple endpoints (edit/web/?domain=, list/backup/?backup=, list/rrd/?period=, list/directory/?dir_a=, and list/directory/ URIs), allowing an...

CVE-2018-18547

Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dira parameter, or the filename to the list/directory/ URI...

PT-2018-14507

Name of the Vulnerable Software and Affected Versions Vesta Control Panel versions prior to 0.9.8-22 Description The issue allows for XSS attacks through various parameters, including the domain parameter in the "edit/web/" endpoint, the backup parameter in the "list/backup/" endpoint, the period...

VestaCP Cross-Site Scripting Vulnerability

VestaCP is a hosting control panel. A cross-site scripting vulnerability exists in VestaCP 0.9.8-22 and prior versions. A remote attacker can exploit this vulnerability to execute JavaScript code in a user's browser...