CVE-2013-10053: Improper Neutralization of Special Elements used in an OS Command

A remote command execution vulnerability exists in ZPanel version 10.0.0.2 in its htpasswd module. When creating .htaccess files, the inHTUsername field is passed unsanitized to a system call that invokes the system’s htpasswd binary. By injecting shell metacharacters into the username field, an...

PT-2025-31689 · Zpanel · Zpanel

Name of the Vulnerable Software and Affected Versions: ZPanel version 10.0.0.2 Description: A remote command execution issue exists in the htpasswd module. The inHTUsername field, when creating .htaccess files, is passed to a system call without proper sanitization, which invokes the system’s...

CVE-2013-2097

ZPanel through 10.1.0 has Remote Command Execution...

CVE-2012-5686

ZPanel 10.0.1 has insufficient entropy for its password reset process...

CVE-2013-2097

ZPanel through 10.1.0 has Remote Command Execution...

Command injection

ZPanel through 10.1.0 has Remote Command Execution...

CVE-2013-2097

ZPanel through 10.1.0 has Remote Command Execution...

CVE-2013-2097

CVE-2013-2097 affects ZPanel up to version 10.1.0, with remote command execution reportedly possible without authentication. Multiple sources corroborate that the issue involves ZPanel and a vulnerable component (pChart), enabling an attacker to read files or execute code on the server. The Red H...

CVE-2013-2097: Undefined Security Weakness

ZPanel through 10.1.0 has Remote Command Execution...

CVE-2012-5686

ZPanel 10.0.1 has insufficient entropy for its password reset process...

Design/Logic Flaw

ZPanel 10.0.1 has insufficient entropy for its password reset process...

CVE-2012-5686

CVE-2012-5686 affects ZPanel 10.0.1 and is caused by insufficient entropy in the password reset process. The Red Hat and NVD entries, as well as related advisories, consistently describe the issue as a password-reset entropy weakness in ZPanel 10.0.1. Documented impact is high/critical depending ...

CVE-2012-5686

ZPanel 10.0.1 has insufficient entropy for its password reset process...

CVE-2012-5686: Weak Password Recovery Mechanism for Forgotten Password

ZPanel 10.0.1 has insufficient entropy for its password reset process...

CVE-2013-10053

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/zpanelusernameexec.rb 2025-10-23 21:12:57+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7 2026-09-08 06:50:53+00:00| seen|...

Zpanel - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/exploit/phpexe' require 'nokogiri' require 'uri' class Metasploit3 'Zpanel Remote Unauthenticated RCE', 'Description' = %q This modul...

Zpanel Remote Unauthenticated Remote Code Execute Exploit

Exploit for php platform in category remote exploits require 'msf/core' require 'msf/core/exploit/phpexe' require 'nokogiri' require 'uri' class Metasploit3 'Zpanel Remote Unauthenticated RCE', 'Description' = %q This module exploits an information disclosure vulnerability found in Zpanel 'dawn...

Zpanel Detection

This script performs HTTP based detection of Zpanel SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

ZPanel Information Disclosure Vulnerability

ZPanel is prone to a remote information disclosure vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zpanel:zpanel";...

Zpanel 10.1.0 Remote Unauthenticated Code Execution

require 'msf/core' require 'msf/core/exploit/phpexe' require 'nokogiri' require 'uri' class Metasploit3 'Zpanel Remote Unauthenticated RCE', 'Description' = %q This module exploits an information disclosure vulnerability found in Zpanel 'dawn isabel', 'brad wolfe', 'brent morris', 'james fitts' ,...