CyberPanel

Records13All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

CyberPanel records in CISA KEV

TI-2024-34345 CyberPanel Incorrect Default Permissions Vulnerability CRITICAL 100KEV 2024-12-04 TI-2024-34482 CyberPanel Incorrect Default Permissions Vulnerability CRITICAL 100KEV 2024-11-07

Components

Products in the NVD configurations · select one to filter the records

Cyberpanel 9 records CRITICAL

Records

13 records

TI-2024-34482 CVE-2024-51567 · GHSA-w6g2-qqv5-83qj

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6…

CRITICAL 100KEV

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMi…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.84402 Published 2024-10-29 No fix listed CWE-306

TI-2024-34345 CVE-2024-51378 · GHSA-c45f-33wq-x2qc

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before…

CRITICAL 100KEV

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatu…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.94748 Published 2024-10-29 No fix listed CWE-78

TI-2026-30062 CVE-2026-41473 · GHSA-xvg9-fp4q-jq9w

CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints

HIGH 79

CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending req…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00793 Published 2026-04-24 Fixed in 2.4.5 CWE-306

TI-2024-34483 CVE-2024-51568 · GHSA-q2hv-8prh-hr3r

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in…

HIGH 79

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.47674 Published 2024-10-29 No fix listed CWE-78

TI-2024-35785 CVE-2024-53376 · GHSA-3fm6-6429-pc94

CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands…

HIGH 73

CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.10895 Published 2024-12-16 No fix listed CWE-78

TI-2021-22562 CVE-2021-47949 · GHSA-47jc-h939-7pj5

CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack

HIGH 73

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00533 Published 2026-05-10 No fix listed CWE-59

TI-2026-30061 CVE-2026-41472 · GHSA-7jgx-wx3x-3fp3

CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard

MEDIUM 57

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attacker…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00516 Published 2026-04-24 Fixed in 2.4.5 CWE-79

TI-2019-09780 CVE-2019-13056 · GHSA-p4j4-h6c2-mgj5

An issue was discovered in CyberPanel through 1.8.4.

MEDIUM 40

An issue was discovered in CyberPanel through 1.8.4.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00838 Published 2019-07-02 No fix listed CWE-352

TI-2026-23384 CVE-2026-29811 · GHSA-2m73-7wxp-874w

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that…

LOW 34

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00336 Published 2026-09-13 Fixed in 2.4.4 CWE-1025

TI-2024-36642 CVE-2024-54679 · GHSA-35r4-377q-pc5v

CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.

LOW 31

CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00963 Published 2024-12-05 No fix listed CWE-862

TI-2024-37118 CVE-2024-56112 · GHSA-987w-wp8x-h99m

CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.

LOW 27

CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00253 Published 2024-12-16 No fix listed CWE-79

TI-2026-23385 CVE-2026-29812 · GHSA-35w8-hjmq-qcx9

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.

LOW 20

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00277 Published 2026-09-13 Fixed in 2.4.4 CWE-778

TI-2026-23383 CVE-2026-29810 · GHSA-vfv6-g6x5-rcp8

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.

LOW 20

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00309 Published 2026-09-13 Fixed in 2.4.4 CWE-390

Open these records in search →

Critical	3
High	5
Medium	5
Low	0
No CVSS	0