ISPConfig

Records13All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

ISPConfig records in CISA KEV

No ISPConfig vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Ispconfig 12 records HIGH

Records

13 records

TI-2026-44091 CVE-2026-61518 · GHSA-m99h-35x2-cjq2

ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter

HIGH 73

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00456 Published 2026-08-19 No fix listed CWE-89

TI-2023-25289 CVE-2023-46818 · GHSA-qfc7-gwmc-9vvr

An issue was discovered in ISPConfig before 3.2.11p1.

HIGH 67

An issue was discovered in ISPConfig before 3.2.11p1.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.19227 Published 2023-10-27 No fix listed CWE-94

TI-2013-03171 CVE-2013-3629 · GHSA-hrjp-9g8g-g9qr

ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution

HIGH 67

ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.43103 Published 2020-02-07 No fix listed

TI-2012-01860 CVE-2012-2087 · GHSA-j6w8-85rp-mrwv

ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.

MEDIUM 47

ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02714 Published 2020-01-23 No fix listed CWE-732

TI-2021-02160 CVE-2021-3021 · GHSA-hm3v-rmvw-rq7w

ISPConfig before 3.2.2 allows SQL injection.

MEDIUM 46

ISPConfig before 3.2.2 allows SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02142 Published 2021-01-05 No fix listed CWE-89

TI-2020-07516 CVE-2020-9398 · GHSA-83jw-q574-9vc6

ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option…

MEDIUM 45

ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01266 Published 2020-02-25 No fix listed CWE-89

TI-2017-12708 CVE-2017-17384 · GHSA-4jgp-67cj-x7v5

ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.

MEDIUM 41

ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01489 Published 2017-12-07 No fix listed CWE-269

TI-2006-02255 CVE-2006-2315 · GHSA-j629-vw9x-r3c2

PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier…

MEDIUM 41

PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the go_info[server][classes_root] parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04941 Published 2006-05-12 No fix listed CWE-94

TI-2018-12803 CVE-2018-17984 · GHSA-8h5j-7xvq-97fq

An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible…

MEDIUM 40

An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.03369 Published 2018-10-04 No fix listed CWE-185

TI-2006-02946 CVE-2006-3042 · GHSA-cq4h-jg73-mw34

Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote…

LOW 38

Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) go_info[isp][classes_root] parameter in (a) server.inc.php, and the (2) go_i…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02875 Published 2006-06-15 No fix listed

TI-2015-03460 CVE-2015-4119 · GHSA-9965-949q-q7q9

Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7…

LOW 33

Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a r…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01251 Published 2015-06-15 No fix listed CWE-352

TI-2015-03459 CVE-2015-4118 · GHSA-q3xp-wrf7-p8pf

SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7…

LOW 33

SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.0212 Published 2015-06-15 No fix listed CWE-89

TI-2025-32507 CVE-2025-52206 · GHSA-8vmq-hhfp-pr66

ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.

LOW 21

ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00213 Published 2026-05-05 No fix listed CWE-79

Open these records in search →

Critical	3
High	7
Medium	3
Low	0
No CVSS	0