CVE-2020-15430

This CVE (CVE-2020-15430) affects CentOS Web Panel, version cwp-e17.0.9.8.923. The vulnerability resides in ajax_list_accounts.php; the code path parsing the username parameter does not properly validate input before using it to execute a system call, allowing remote attackers to execute arbitrar...

CVE-2020-15619

CentOS Web Panel (cwp-e17.0.9.8.923) is affected by a SQL injection in ajax_list_accounts.php when parsing the type parameter. The vulnerability allows remote attackers, with no authentication, to disclose sensitive information in the root context by constructing SQL queries from unvalidated user...

CVE-2019-13477

CWP Control Web Panel version 0.9.8.837 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in the Forgot Password feature, enabling an attacker to change the root password. Root cause: CSRF in the forgot-password flow exposes account password changes to unauthorized requests. Impact...

CVE-2019-13599

CVE-2019-13599 affects CentOS Web Panel (CWP) 0.9.8.848, where the login process can be used to determine if a username is valid by comparing response times, creating a user-enumeration timing side-channel. The vulnerability is documented across multiple sources (NVD, Red Hat, CNVD, PRION, etc.) ...

CVE-2019-14723

CVE-2019-14723 affects CentOS Web Panel 0.9.8.851 (CWP). The flaw is an insecure object reference that lets an attacker with an attacker account delete a victim’s e-mail account. Root cause is insufficient access control/object reference handling within the CWP email management flow. Documented i...

CVE-2019-14725

CVE-2019-14725 affects CentOS Web Panel 0.9.8.851. Affected component is an insecure object reference that lets an attacker with an account modify the email usage value of another victim’s account. The root cause is inadequate access control on object references, enabling privilege escalation wit...

CVE-2020-15421

CVE-2020-15421 affects CentOS Web Panel (cwp-e17.0.9.8.923); the vulnerability resides in ajax_mod_security.php during parsing of the check_ip parameter, where user-supplied input is used to form a system call without proper validation, enabling remote code execution as root. Multiple sources (in...

CVE-2023-42120

CVE-2023-42120 affects Control Web Panel via the dns_zone_editor module, where improper validation of a user-supplied string before a system call enables remote code execution with root privileges. Impact is high (RCE, root, network exploit) and requires authentication to exploit. The entry is co...

CVE-2020-15424

This CVE (CVE-2020-15424) affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mod_security.php when parsing the domain parameter, where unvalidated user input is used to execute a system call, allowing remote code execution as root without authentication. Documented impact mirrors Z...

CVE-2020-15426

The CVE-2020-15426 issue affects CentOS Web Panel (CWP) on version cwp-e17.0.9.8.923. The root cause is a failure to validate the user-supplied serverip string in ajax_migration_cpanel.php before using it in a system call, enabling remote code execution with root privileges. Access does not requi...

CVE-2020-15435

The CVE-2020-15435 issue affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is in ajax_dashboard.php where parsing the service_start parameter allows an attacker to construct a system call, enabling remote code execution with root privileges. It is exploitable remotely without authen...

CVE-2020-15614

CVE-2020-15614 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_php_pecl.php when parsing the cha parameter, where input is not properly validated before a system call, allowing an unauthenticated attacker to execute arbitrary code with root privileges. This has been disclosed in...

CVE-2018-5962

CVE-2018-5962 affects CentOS Web Panel (CWP) up to version v0.9.8.12 via XSS in index.php. The vulnerability is triggered by the id parameter in the phpini_editor module or the email_address parameter in the mail_add-new module, allowing cross-site scripting. Public sources in connected records c...

CVE-2019-15235

The CVE-2019-15235 entry concerns CentOS Web Panel (CWP) prior to 0.9.8.864. The vulnerability lets an attacker obtain a victim’s session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx and the token value from /usr/local/cwpsrv/logs/access_log, then use these to access the victim’s passw...

CVE-2020-15612

CVE-2020-15612 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_ftp_manager.php where parsing the userLogin parameter allows an attacker to execute arbitrary code with root privileges via a remote attack, without authentication. This is documented across multiple sources, includi...

CVE-2020-15606

CVE-2020-15606 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is a remote code execution flaw in ajax_admin_apis.php caused by insufficient validation of a user-supplied string used to call a system command, allowing an unauthenticated attacker to execute code as root. Public dis...

CVE-2020-15620

The CVE-2020-15620 issue affects CentOS Web Panel (cwp-e17.0.9.8.923) and is a SQL injection in ajax_list_accounts.php where the id parameter is used to build queries without proper validation, enabling information disclosure in the context of root. This is documented across multiple sources (ZDI...

CVE-2019-14730

CVE-2019-14730 affects CentOS Web Panel 0.9.8.851. The vulnerability is an insecure object reference that allows an attacker with an account to delete a domain from another user’s account. Root cause: insufficient access control around domain management/object references. Impact: unauthorized dom...

CVE-2020-15429

CVE-2020-15429 affects CentOS Web Panel (cwp-e17.0.9.8.923). A flaw in ajax_crons.php allows remote command injection: when parsing the user parameter, the code does not properly validate the string before using it in a system call, enabling arbitrary code execution with root privileges. Authenti...

CVE-2020-15432

The CVE-2020-15432 entry affects CentOS Web Panel (CWP) software, specifically cwp-e17.0.9.8.923. The underlying issue is in ajax_migration_cpanel.php where the filespace parameter is not properly validated before use in a system call, enabling remote code execution with root privileges and no au...

CVE-2020-15624

CVE-2020-15624 affects CentOS Web Panel (CWP) — version cwp-e17.0.9.8.923 — where the ajax_new_account.php component does not properly validate the domain parameter before constructing SQL queries, enabling an unauthenticated remote SQL injection that can disclose sensitive information in the con...

CVE-2020-15425

CVE-2020-15425 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability resides in ajax_mod_security.php and stems from improper validation of a user-supplied string used to perform a system call, enabling remote code execution with root privileges. Exploitation does not require authentica...

CVE-2020-15431

CVE-2020-15431 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_crons.php where parsing the user parameter allows executing a system call with root privileges, enabling remote code execution without authentication. Multiple sources (including ZDI-20-748) document this as a remote...

CVE-2020-15423

CVE-2020-15423 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is in ajax_mod_security.php where parsing the dominio parameter allows an attacker to bypass validation and execute a system call, yielding remote code execution with root privileges. Multiple connected sources corrobo...

CVE-2020-15622

CVE-2020-15622 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mail_autoreply.php where unvalidated user input in the search parameter is used to construct SQL queries, enabling an unauthenticated attacker to disclose sensitive information, in the context of root. Multiple trust...

CVE-2020-15628

CVE-2020-15628 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mail_autoreply.php where the parameter parsing for the user input is not properly validated before being used to build SQL queries, enabling a remote SQL injection in the root context. Authentication is not required....

CVE-2020-15433

CVE-2020-15433 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_php_pecl.php when parsing the phpversion parameter, which allows an unauthenticated attacker to execute arbitrary code with root privileges via a remote code execution vector. Multiple sources (including ZDI-20-750) ...

CVE-2019-13476

CVE-2019-13476 affects CentOS Web Panel (CWP) 0.9.8.837. A stored cross-site scripting (XSS) vulnerability in the domain parameter on the email list page allows a low-privilege user to escalate to root access. The issue is documented across multiple sources, including Red Hat, CNVD, CVE records, ...

CVE-2020-15621

CVE-2020-15621 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw is in ajax_mail_autoreply.php where the email parameter is used to construct SQL queries without proper validation, allowing remote attackers to disclose sensitive information in the context of root. Multiple sources (ZDI-20-76...

CVE-2020-15617

CVE-2020-15617 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is a SQL injection in ajax_list_accounts.php where the status parameter is not properly validated before being used in queries, enabling remote disclosure of sensitive information with no authentication. This is docume...

CVE-2020-15626

CVE-2020-15626 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability is an SQL injection in ajax_dashboard.php when parsing the term parameter, allowing remote attackers to disclose sensitive information in the root context without authentication. Public references from ZDI-20-773 and r...

CVE-2020-15616

CVE-2020-15616 affects CentOS Web Panel (cwp-e17.0.9.8.923). The flaw resides in ajax_list_accounts.php where parsing of the package parameter enables unauthenticated remote SQL information disclosure in the context of root due to inadequate input validation when building queries. Multiple source...

CVE-2018-5961

CVE-2018-5961 affects CentOS Web Panel up to v0.9.8.12, where an XSS vulnerability exists via the module parameter in the index.php file. The issue is described as a Cross-Site Scripting vulnerability (non-persistent) that can lead to script execution in a victim’s browser. Public details across ...

CVE-2020-15618

The CVE-2020-15618 issue affects CentOS Web Panel (cwp-e17.0.9.8.923) and is a SQL injection in ajax_list_accounts.php triggered by the username parameter. It allows remote, unauthenticated attackers to disclose sensitive information in the root context. The vulnerability is documented by ZDI (ZD...

CVE-2020-15625

CVE-2020-15625 affects CentOS Web Panel (cwp-e17.0.9.8.923). The vulnerability resides in the ajax_add_mailbox.php component, where the username parameter is used to construct SQL queries without proper validation, enabling an unauthenticated attacker to disclose sensitive information in the cont...