CVE-2025-49132

🛡️ Pterodactyl Panel Vulnerability Checker & Exploit Tool ✨ Acerca de Un script Python que automatiza el descubrimiento y explotación de vulnerabilidades en paneles Pterodactyl mal configurados. 🔍 Descubre exposición de la configuración sensible archivo locale.json. 🔑 Extrae credenciales de la bas...

CVE-2025-49132-PHP-PEAR

CVE-2025-49132: RCE no autenticado en Pterodactyl Panel mediante el método PHP PEAR Tabla de contenidos Descripción general Detalles de la vulnerabilidad Análisis técnico Flujo del exploit Instalación Uso Ejemplos Mitigación Descargo de responsabilidad Referencias Autor Descripción general Este...

CVE-2025-49132

CVE-2025-49132 - 10.0 Crítico https://github.com/pterodactyl/panel/security/advisories/GHSA-24wv-6c99-f843 Versiones vulnerables: 1.9.0 .. 1.11.10 Consideraciones de OpSec La explotación de RCE es limitada, pero se puede detectar mediante: cat /var/www/pterodactyl/storage/logs/laravel-2025--.log ...

CVE-2025-49132-Pterodactyl-Panel-Unauthenticated-Remote-Code-Execution-RCE-

CVE-2025-49132 Panel Pterodactyl - Ejecución Remota de Código No Autenticada RCE 🔎 Resumen CVE‑2025‑49132 es una vulnerabilidad crítica de Ejecución Remota de Código que afecta a Pterodactyl Panel = 1.11.10. Un atacante no autenticado puede explotar una validación de entrada incorrecta en el...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2026-86177

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2026-86177 Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2026-86177

Pterodactyl Panel versions before 1.14.1 fail to validate action-specific permissions when creating scheduled tasks. A subuser holding only the schedule.update permission can create and immediately trigger scheduled tasks that execute arbitrary game-server console commands , control server power ...

CVE-2026-86177 Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

EUVD-2026-71976

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2025-49132

CVE-2025-49132 — RCE di Pterodactyl Strumento di exploit per CVE-2025-49132 — una vulnerabilità critica di esecuzione arbitraria di codice non autenticata che colpisce il pannello del server di gioco Pterodactyl. 🧠 Cos'è CVE-2025-49132 ? Una falla ACE critica nel pannello Pterodactyl che consente...

CVE-2026-61617

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

CVE-2026-61617 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

CVE-2026-61617 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

CVE-2026-61617

Wings , the server control plane for the Pterodactyl game-server management panel, contains a disk-quota enforcement flaw in its SFTP write path (versions up to and including 1.13.2 ). Wings checks available disk space only once as a boolean when the write handle is opened—using a stale cached va...

CVE-2026-52855

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

CVE-2026-52856

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0...

CVE-2026-52856

Wings (server control plane for Pterodactyl) contains a vulnerability in which a malformed packet during the SFTP handshake can trigger a Go panic. This affects versions prior to 1.13.0. The issue is resolved in 1.13.0. Impact is described as a denial of service (Go panic) with a HIGH CVSS v3.1 b...

CVE-2026-52856 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0...

CVE-2026-52855

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...