TI-2020-12284 CVE-2020-15609 · GHSA-h9cr-cxm7-hxwf
OS command injection in CentOS Web Panel
Priority MEDIUM 53
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.
CentOS Web Panel
Records45All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical28CVSS 9.0–10.0
CVSS high13CVSS 7.0–8.9
Exploited now
CentOS Web Panel records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Centos Web Panel · all components
TI-2019-10056 CVE-2019-13386 · GHSA-ff37-hv4q-764f
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in…
Priority MEDIUM 43
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege.
TI-2019-10606 CVE-2019-14246 · GHSA-mjjr-ggh8-rjgq
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference…
Priority LOW 33
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin passwords (of any user in /etc/passwd) via an attacker account.
TI-2019-10605 CVE-2019-14245 · GHSA-4vp3-jqp3-fqxc
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference…
Priority LOW 33
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account.
TI-2019-08114 CVE-2019-10893 · GHSA-w67j-wff9-42gj
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and…
Priority LOW 27
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen.
TI-2019-07573 CVE-2019-10261 · GHSA-qq9j-9m8w-8hq5
CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name…
Priority LOW 27
CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action.