TI-2023-25289 CVE-2023-46818 · GHSA-qfc7-gwmc-9vvr
An issue was discovered in ISPConfig before 3.2.11p1.
Priority HIGH 67
An issue was discovered in ISPConfig before 3.2.11p1.
ISPConfig
Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9
Exploited now
ISPConfig records in CISA KEVNo ISPConfig vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records in Ispconfig · all components
TI-2013-03171 CVE-2013-3629 · GHSA-hrjp-9g8g-g9qr
ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution
Priority HIGH 67
ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution
TI-2012-01860 CVE-2012-2087 · GHSA-j6w8-85rp-mrwv
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
Priority MEDIUM 47
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
TI-2021-02160 CVE-2021-3021 · GHSA-hm3v-rmvw-rq7w
ISPConfig before 3.2.2 allows SQL injection.
Priority MEDIUM 46
ISPConfig before 3.2.2 allows SQL injection.
TI-2020-07516 CVE-2020-9398 · GHSA-83jw-q574-9vc6
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option…
Priority MEDIUM 45
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
TI-2017-12708 CVE-2017-17384 · GHSA-4jgp-67cj-x7v5
ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
Priority MEDIUM 41
ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
TI-2006-02255 CVE-2006-2315 · GHSA-j629-vw9x-r3c2
PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier…
Priority MEDIUM 41
PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the go_info[server][classes_root] parameter.
TI-2018-12803 CVE-2018-17984 · GHSA-8h5j-7xvq-97fq
An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible…
Priority MEDIUM 40
An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution.
TI-2006-02946 CVE-2006-3042 · GHSA-cq4h-jg73-mw34
Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote…
Priority LOW 38
Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) go_info[isp][classes_root] parameter in (a) server.inc.php, and the (2) go_i…
TI-2015-03460 CVE-2015-4119 · GHSA-9965-949q-q7q9
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7…
Priority LOW 33
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a r…
TI-2015-03459 CVE-2015-4118 · GHSA-q3xp-wrf7-p8pf
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7…
Priority LOW 33
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter.
TI-2025-32507 CVE-2025-52206 · GHSA-8vmq-hhfp-pr66
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.
Priority LOW 21
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.