146 matches found
CVE-2021-45467
In CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/accountnewcreate&acc=guadaapi URI. Any number of %00...
CVE-2021-45466
In CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1107, attackers can make a crafted request to api/?api=addserver&DHCP= to add an authorizedkeys text file in the /resources/ folder...
Code injection
In CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/accountnewcreate&acc=guadaapi URI. Any number of %00...
Design/Logic Flaw
In CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1107, attackers can make a crafted request to api/?api=addserver&DHCP= to add an authorizedkeys text file in the /resources/ folder...
CVE-2021-45466
CVE-2021-45466: In CWP (Control Web Panel/CentOS Web Panel) before 0.9.8.1107, a crafted request to api/?api=add_server&DHCP= can cause an authorized_keys file to be written under /resources/. This is a remote, unauthenticated exploit with high impact. CVE-2021-45467: In the same platform before ...
CVE-2021-45466
In CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1107, attackers can make a crafted request to api/?api=addserver&DHCP= to add an authorizedkeys text file in the /resources/ folder...
CVE-2021-45467
In CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/accountnewcreate&acc=guadaapi URI. Any number of %00...
CVE-2021-45467
CWP (Control Web Panel / CentOS Web Panel) is affected by CVE-2021-45467 in versions before 0.9.8.1107. The issue is an unauthenticated null-byte (%00) injection in the scripts parameter of /user/loader.php (and /user/login.php) that can be exploited to register arbitrary API keys or access sensi...
CVE-2022-25047
The password reset token in CWP v0.9.8.1126 is generated using known or predictable values...
CVE-2022-25047
The password reset token in CWP v0.9.8.1126 is generated using known or predictable values...
CVE-2022-25048
Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user...
CVE-2022-25046
A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...
Path traversal
A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...
Command injection
Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user...
CVE-2022-25048
Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user...
CVE-2022-25048
Summary : CVE-2022-25048 is a command injection vulnerability in CWP (CentOS Web Panel) version v0.9.8.1126 . The description states that a normal user can execute commands with root privileges. Affected component : CWP panel software (v0.9.8.1126). Impact : Elevation of privileges via command ex...
CVE-2022-25047
CVE-2022-25047 affects CWP v0.9.8.1126, where the password reset token is generated using known or predictable values. This is the root cause described across multiple sources (NVD entry and related advisories). No exploit specifics or official fix/version is provided in the supplied documents. S...
CVE-2022-25047
The password reset token in CWP v0.9.8.1126 is generated using known or predictable values...
CVE-2022-25046
The CVE-2022-25046 entry describes a path traversal vulnerability in loader.php of CWP (CentOS Web Panel) v0.9.8.1122 that enables arbitrary code execution via a crafted POST request. Evidence from NVD shows a critical CVSS v3.1 score (9.8) and CVSS v2 score (10.0). Affected component: loader.php...