CVE-2026-54593

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

CVE-2026-54593 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

PT-2026-65514

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server uuid, user uuid, and unique id claims without checking the token's intended purpose;...

EUVD-2025-28375

Malicious code in bioql PyPI...

CVE-2025-56413

OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the /api/v2/hosts/ssh/operate endpoint...

CVE-2025-24364

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Attacker with authenticated access to the vaultwarden admin panel can execute arbitrary code in the system. The attacker could then change some settings to use sendmail as mail agent but adjus...

CVE-2024-22646

An email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0. This allows an attacker to guess which emails exist on the system...

CVE-2024-22648

A Blind SSRF vulnerability exists in the "Crawl Meta Data" functionality of SEO Panel version 4.10.0. This makes it possible for remote attackers to scan ports in the local environment...

PT-2023-26787 · Ecshop · Ecshop

Name of the Vulnerable Software and Affected Versions: ECShop version 4.1.16 Description: The issue is related to an arbitrary file deletion vulnerability in the Admin Panel. Recommendations: For ECShop version 4.1.16, at the moment, there is no information about a newer version that contains a f...

CVE-2023-2886

Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7...

CVE-2023-2882

Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7...

CVE-2023-2887

Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7...

CVE-2021-26266

cPanel before 92.0.9 allows a Reseller to bypass the suspension lock SEC-578...

CentOS Web Panel Operating System Command Injection Vulnerability

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxftpmanager.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from the program failing to properly validate a system call before executing it with a...

Xavier PHP Management Panel Buffer Overflow Vulnerability

Xavier PHP Management Panel is a website user management system. A buffer overflow vulnerability exists in Xavier PHP Management Panel version 3.0. The vulnerability arises when a web system or product performs an operation in memory without properly validating data boundaries, resulting in an...

Stored Cross-Site Scripting Vulnerability in SS-Panel

SS-Panel is a front-end program that works with Shadowsocks-Manyuser. A stored cross-site scripting vulnerability exists in SS-Panel version 3.3.9. Since HttpOnly is not enabled by default, an attacker can exploit the vulnerability to obtain an administrator cookie and use the cookie to log in to...

SEO Control Panel 3.6.0 SQL Injection Vulnerability

SEO Control Panel version 3.0 suffers from a remote authenticated SQL injection vulnerability. Exploit Title: Seo Control Panel 3.6.0 Authenticated Sql Injection Date: 10/10/2014 Exploit Author: Tiago Carvalho email protected or email protected Vendor Homepage: www.seopanel.in Software Link:...