CVE-2021-31324

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution...

CentOS Web Panel 操作系统命令注入漏洞

CentOS Web Panel CWP is a free web hosting control panel from the Control Web Panel community. A security vulnerability exists in CentOS Web Panel that originates in the Unprivileged User Portal section that is affected by a command injection vulnerability that can be exploited by an attacker to...

PT-2021-19242 · Unknown · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel affected versions not specified Description: The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection issue, which can lead to root Remote Code Execution. Recommendations: At the moment, there ...

CentOS Web Panel SQL注入漏洞

CentOS Web Panel CWP is a free web hosting control panel from the Control Web Panel community. A SQL injection vulnerability exists in CentOS Web Panel that allows unprivileged users to attack via the idsession, an HTTP POST parameter...

PT-2021-19237 · Unknown · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel affected versions not specified Description: The issue affects the unprivileged user portal part of CentOS Web Panel, where a SQL Injection is possible via the idsession HTTP POST parameter. Recommendations: At the moment,...

Sipwise C5 NGCP CSC - 'Multiple' Persistent Cross-Site Scripting (XSS)

Exploit Title: Sipwise C5 NGCP CSC - 'Multiple' Stored/Reflected Cross-Site Scripting XSS Date: 13.04.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.sipwise.com Sipwise C5 NGCP CSC Multiple Stored/Reflected XSS Vulnerabilities Vendor: Sipwise GmbH Product web page:...

NETGEAR JGS516PE/GS116Ev2 Cross-Site Scripting Vulnerability

The NETGEAR JGS516PE/GS116Ev2 is a 16-port Gigabit Smart Managed Plus switch. A cross-site scripting vulnerability exists in the management web panel of the NETGEAR JGS516PE/GS116Ev2 version 2.6.0.43. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...

CVE-2020-35230

Multiple integer overflow parameters were found in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices. Most of the integer parameters sent through the web server can be abused to cause a denial of service attack...

Cross site scripting

A cross-site scripting XSS vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the language parameter...

CVE-2020-35228

CVE-2020-35228 affects NETGEAR JGS516PE/GS116Ev2 switches running v2.6.0.43, where the administration web panel is vulnerable to cross-site scripting via the language parameter. The issue is described as an XSS in the management web interface that could allow attackers to inject arbitrary script/...

CVE-2020-17503

The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in splitcardcmd.php in which the http parameter "lockin...

Backdoor in Zyxel Firewalls and Gateways

This is bad: More than 100,000 Zyxel firewalls, VPN gateways, and access point controllers contain a hardcoded admin-level backdoor account that can grant attackers root access to devices via either the SSH interface or the web administration panel. … Installing patches removes the backdoor...

Fastweb FASTGate Cross-Site Request Forgery Vulnerability (CNVD-2020-67310)

Fastweb FASTGate is a modem from Fastweb Italy. A cross-site request forgery vulnerability exists in Fastweb FASTGate GPON FGA2130FWB version 2020-05-26 and prior versions that allows CSRF to manage web panels through the router, which could be exploited by an attacker to be able to perform...

CVE-2020-13620

Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's ability to perform administrative actions such as modifying the configuration...

CVE-2020-13620

CVE-2020-13620 describes a cross-site request forgery (CSRF) vulnerability in Fastweb FASTGate GPON FGA2130FWB devices up to 2020-05-26, allowing an attacker to perform administrative actions by abusing the router’s web panel. Affected component is the router administration web interface; root ca...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44598)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxcrons.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from failure to properly validate a user-supplied string before executing a system call. An...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44600)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxmodsecurity.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from the program failing to properly validate a system call before executing it with ...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44595)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxphppecl.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from failure to properly validate user-supplied strings before executing system calls. An...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44593)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxdashboard.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from failure to properly validate a user-supplied string before executing a system call...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44597)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxlistaccounts.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from a failure to properly validate a user-supplied string before executing a system...