CVE-2022-25048

Summary : CVE-2022-25048 is a command injection vulnerability in CWP (CentOS Web Panel) version v0.9.8.1126 . The description states that a normal user can execute commands with root privileges. Affected component : CWP panel software (v0.9.8.1126). Impact : Elevation of privileges via command ex...

CVE-2022-25047

CVE-2022-25047 affects CWP v0.9.8.1126, where the password reset token is generated using known or predictable values. This is the root cause described across multiple sources (NVD entry and related advisories). No exploit specifics or official fix/version is provided in the supplied documents. S...

CVE-2022-25047

The password reset token in CWP v0.9.8.1126 is generated using known or predictable values...

CVE-2022-25046

The CVE-2022-25046 entry describes a path traversal vulnerability in loader.php of CWP (CentOS Web Panel) v0.9.8.1122 that enables arbitrary code execution via a crafted POST request. Evidence from NVD shows a critical CVSS v3.1 score (9.8) and CVSS v2 score (10.0). Affected component: loader.php...

CVE-2022-25046

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...

CWP Panel 操作系统命令注入漏洞

CWP Panel is a modern and advanced Linux control panel from CWP Inc. It is suitable for web hosting service providers and system administrators. A security vulnerability exists in CWP Panel version v0.9.8.1126. An attacker can exploit the vulnerability to run commands as root user...

CVE-2022-25046: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...

CWP Panel 路径遍历漏洞

CWP Panel is a modern and advanced Linux control panel from CWP Inc. It is intended for web hosting service providers and system administrators. A security vulnerability exists in CWP Panel version v0.9.8.1122, which stems from a path traversal vulnerability in loader.php. An attacker can exploit...

PT-2022-17064

Name of the Vulnerable Software and Affected Versions CWP version 0.9.8.1126 Description The issue allows normal users to run commands as the root user due to a command injection vulnerability. Recommendations For CWP version 0.9.8.1126, at the moment, there is no information about a newer versio...

CVE-2022-25048: Improper Neutralization of Special Elements used in an OS Command

Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user...

CVE-2022-25047: Use of Insufficiently Random Values

The password reset token in CWP v0.9.8.1126 is generated using known or predictable values...

Stored XSS via HTML fields in SilverStripe Framework

SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

GHSA-JX34-GQQQ-R6GM Stored XSS via HTML fields in SilverStripe Framework

SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

CVE-2022-25238

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

CVE-2022-25238

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

CVE-2022-25238

CVE-2022-25238 affects the SilverStripe Framework up to version 4.10.0, where an authenticated CMS user can inject tokens into script content via XHR, enabling XSS when the cwp-core module is not installed and sanitise_server_side contig is not true. The issue is documented across multiple source...

CVE-2022-25238: Improper Neutralization of Input During Web Page Generation

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

GHSA-H77W-655F-6J3M Silverstripe CMS malicious file upload enables script execution

Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions for example HTML code in a TXT file. When these files are stored as protected or draft files, the MIME detection can cause browsers to execute the file contents. Upload...

SilverStripe Folders migrated from 3.x may be unsafe to upload to

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is...

CWP Panel 代码注入漏洞

CWP Panel is a modern and advanced Linux control panel from CWP Inc. for web hosting service providers and system administrators. A code injection vulnerability exists in CWP Panel el8-latest, which could allow a remote attacker to execute arbitrary code on an affected system...