23 matches found
CVE-2026-65638
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
CVE-2026-65638
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
EUVD-2026-75595
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
CVE-2026-65639
ConfigServer Security & Firewall (CSF) is vulnerable to OS command injection in its advanced-rule parser . An attacker who controls a configured allow/deny feed can inject commands that execute with root privileges , due to insufficient validation of feed-supplied rule data. The vulnerability aff...
CVE-2026-65638
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
CVE-2026-65638
ConfigServer Security & Firewall (CSF) is vulnerable to shell command injection due to improper escaping of a request URL. An unauthenticated remote attacker can exploit this to execute arbitrary commands as the CSF service account. The CVSS 4.0 score is 9.2 (Critical) with a network attack vecto...
CVE-2026-65638: Improper Neutralization of Special Elements used in an OS Command
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
CVE-2026-67402
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...
EUVD-2026-42144
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This result...
CVE-2026-56843: Insufficiently Protected Credentials
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This result...
WebPros WHMCS 安全漏洞
WebPros WHMCS is a customer management and automated billing platform provided by the Swiss company WebPros, aimed at hosting providers and domain service providers. There is a security vulnerability in WebPros WHMCS, which stems from insufficient ownership checks in the clientarea.php file. This...
WebPros Comet Backup 安全漏洞
WebPros Comet Backup is a data backup and recovery platform developed by the Swiss company WebPros. Versions 20.11.0 to 26.1.1, and 26.2.1 of WebPros Comet Backup contain security vulnerabilities. These vulnerabilities stem from insecure direct object references, allowing tenant administrators to...
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
WebPros cPanel & WHM WebHost Manager and WP2 WordPress Squared contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel...
CVE-2025-66428
An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation...
CVE-2025-66428
An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation...
CVE-2025-66428
An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation...
CVE-2025-66428
An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation...
CVE-2025-66428: Improper Limitation of a Pathname to a Restricted Directory
An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation...
WebPros WordPress Toolkit security vulnerabilities
The WebPros WordPress Toolkit is a WordPress management platform provided by the Swiss company WebPros. Versions of the WebPros WordPress Toolkit prior to 6.9.1 contained security vulnerabilities; these vulnerabilities were caused by issues with the WordPress directory names, which could lead to...
CVE-2025-66428
The WebPros WordPress Toolkit is vulnerable to a privilege escalation flaw in versions prior to 6.9.1 . The root cause is an issue involving the manipulation of WordPress directory names . To remediate this vulnerability, users are recommended to update the WordPress Toolkit to version 6.9.1 or l...