1174 matches found
CVE-2025-48703
CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the ttotal parameter in a filemanager changePerm request. A valid non-root username must be known...
Control Web Panel 操作系统命令注入漏洞
Control Web Panel is a Linux web hosting control panel. An operating system command injection vulnerability exists in Control Web Panel versions prior to 0.9.8.1205, which stems from the ttotal parameter in the filemanager changePerm request containing shell metacharacters, which could lead to...
VulnCheck KEV: CVE-2025-48703
CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the ttotal parameter in a filemanager changePerm request. A valid non-root username must be known...
The vulnerability of the application for managing CentOS Web Panel lies in its failure to eliminate certain special elements, allowing a perpetrator to execute arbitrary code.
The vulnerability of the CentOS Web Panel management application relates to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary code...
PT-2025-26757
Name of the Vulnerable Software and Affected Versions CWP aka Control Web Panel or CentOS Web Panel versions prior to 0.9.8.1205 Description CWP Control Web Panel is susceptible to an unauthenticated remote code execution vulnerability. An attacker with knowledge of a valid, non-root username can...
VulnCheck KEV: CVE-2025-34023
A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. The /cgi-bin/cgiServer.exx endpoint fails to properly sanitize user input to the page parameter, allowing remote authenticated attackers to access arbitrary files on the underlying system by using crafted...
CVE-2025-41378
The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file. This can be exploited by an attacker to extend his knowledge of the system and compromise other devices. The information is filtered by the logs function of the web panel...
CVE-2025-41379 Injection vulnerability in Iridium Certus 700
The Intellian C700 web panel allows you to add firewall rules. Each of these rules has an associated ID, but there is a problem when adding a new rule, the ID used to create the database entry may be different from the JSON ID. If the rule needs to be deleted later, the system will use the JSON I...
CVE-2025-41378
The CVE-2025-41378 entry maps to the Iridium Certus 700 (Intellian) vulnerability where the SSID field is not parsed correctly, enabling command injection into the hostpad.conf file. Consequence described across sources is attacker access to system details and potential compromise of additional d...
CVE-2025-41378 Injection vulnerability in Iridium Certus 700
The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file. This can be exploited by an attacker to extend his knowledge of the system and compromise other devices. The information is filtered by the logs function of the web panel...
CVE-2024-56529
Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when HSTS is disabled on a victim's browser. After a user logs in, they are authenticated and the session identifier is valid. Then, a remote attacker can access...
CVE-2023-47316
Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as listing users and their data, file management API calls and audit-related API calls...
CVE-2023-47314
Headwind MDM Web panel 5.22.1 is vulnerable to cross-site scripting XSS. The file upload function allows APK and arbitrary files to be uploaded. By exploiting this issue, attackers may upload HTML files and share the download URL pointing to these files with the victims. As the file download...
CVE-2023-47312
Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries...
CVE-2022-44877
login/index.php in CWP aka Control Web Panel or CentOS Web Panel 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter...
CVE-2021-45467
In CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1= .%00./.%00./api/accountnewcreate=guadaapi URI. Any number of %00 instances can...
CVE-2021-45466
In CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1107, attackers can make a crafted request to api/?api=addserver= to add an authorizedkeys text file in the /resources/ folder...
CVE-2020-11968
In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration which has a required step for settin...
CVE-2020-11963
IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configurati...