CVE-2015-4117

Vesta Control Panel prior to 0.9.8-14 is vulnerable to OS command injection in the backup parameter of /list/backup/index.php. An authenticated user can inject shell metacharacters to execute arbitrary commands with admin privileges, potentially compromising the entire panel. Remediation: upgrade...

CVE-2021-46850

The myVesta Control Panel (before version 0.9.8-26-43) and Vesta Control Panel (before version 0.9.8-26) are vulnerable to command injection . This flaw is caused by a lack of data sanitization at the management level, specifically when the application processes the v_sftp_license parameter durin...

CVE-2022-3967

CVE-2022-3967 affects Vesta Control Panel, specifically the sed Handler component in func/main.sh. The vulnerability enables argument injection and requires local access to exploit. Patch 39561c32c12cabe563de48cc96eccb9e2c655e25 is identified as the fix; apply it to mitigate. Other details in con...