CVE-2020-15622

CVE-2020-15622 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mail_autoreply.php where unvalidated user input in the search parameter is used to construct SQL queries, enabling an unauthenticated attacker to disclose sensitive information, in the context of root. Multiple trust...

CVE-2020-15621

CVE-2020-15621 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mail_autoreply.php where the email parameter is used to construct SQL queries without proper validation, allowing remote attackers to disclose sensitive information in the context of root. Multiple sources (ZDI-20-76...

CVE-2020-15622

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmailautoreply.php. When parsing the search parameter, the...

CVE-2020-15619

CentOS Web Panel (cwp-e17.0.9.8.923) is affected by a SQL injection in ajax_list_accounts.php when parsing the type parameter. The vulnerability allows remote attackers, with no authentication, to disclose sensitive information in the root context by constructing SQL queries from unvalidated user...

CVE-2020-15619

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the type parameter, the...

CVE-2020-15620

The CVE-2020-15620 issue affects CentOS Web Panel (cwp-e17.0.9.8.923) and is a SQL injection in ajax_list_accounts.php where the id parameter is used to build queries without proper validation, enabling information disclosure in the context of root. This is documented across multiple sources (ZDI...

CVE-2020-15620

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the id parameter, the...

CVE-2020-15618

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the username parameter, th...

CVE-2020-15616

CVE-2020-15616 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw resides in ajax_list_accounts.php where parsing of the package parameter enables unauthenticated remote SQL information disclosure in the context of root due to inadequate input validation when building queries. Multiple source...

CVE-2020-15616

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the package parameter, the...

CVE-2020-15617

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the status parameter, the...

CVE-2020-15618

The CVE-2020-15618 issue affects CentOS Web Panel (cwp-e17.0.9.8.923) and is a SQL injection in ajax_list_accounts.php triggered by the username parameter. It allows remote, unauthenticated attackers to disclose sensitive information in the root context. The vulnerability is documented by ZDI (ZD...

CVE-2020-15617

CVE-2020-15617 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is a SQL injection in ajax_list_accounts.php where the status parameter is not properly validated before being used in queries, enabling remote disclosure of sensitive information with no authentication. This is docume...

CVE-2020-15615

The CVE-2020-15615 entry affects CentOS Web Panel (CWP) version cwp-e17.0.9.8.923. The flaw is in ajax_ftp_manager.php, where a user-supplied string is used to construct a system call without proper validation, allowing unauthenticated remote code execution with root privileges. Public references...

CVE-2020-15615

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxftpmanager.php. The issue results from the lack of proper...

CVE-2020-15614

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxphppecl.php. When parsing the cha parameter, the process does not...

CVE-2020-15614

CVE-2020-15614 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_php_pecl.php when parsing the cha parameter, where input is not properly validated before a system call, allowing an unauthenticated attacker to execute arbitrary code with root privileges. This has been disclosed in...

CVE-2020-15613

CVE-2020-15613 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_admin_apis.php when parsing the line parameter, where unsanitized input is used to execute a system call, enabling remote code execution with root privileges and no authentication. Public advisories reference ZDI-20-...

CVE-2020-15613

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxadminapis.php. When parsing the line parameter, the process does...

CVE-2020-15612

CVE-2020-15612 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_ftp_manager.php where parsing the userLogin parameter allows an attacker to execute arbitrary code with root privileges via a remote attack, without authentication. This is documented across multiple sources, includi...