Vulnerabilities

TI-2026-30062 CVE-2026-41473 · GHSA-xvg9-fp4q-jq9w

CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints

HIGH 79

CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending req…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00793 Published 2026-04-24 Fixed in 2.4.5 CWE-306

TI-2026-30061 CVE-2026-41472 · GHSA-7jgx-wx3x-3fp3

CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard

MEDIUM 57

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attacker…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00516 Published 2026-04-24 Fixed in 2.4.5 CWE-79

TI-2024-37118 CVE-2024-56112 · GHSA-987w-wp8x-h99m

CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.

LOW 27

CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00253 Published 2024-12-16 No fix listed CWE-79

TI-2024-35785 CVE-2024-53376 · GHSA-3fm6-6429-pc94

CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands…

HIGH 73

CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.10895 Published 2024-12-16 No fix listed CWE-78

TI-2024-36642 CVE-2024-54679 · GHSA-35r4-377q-pc5v

CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.

LOW 31

CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00963 Published 2024-12-05 No fix listed CWE-862

TI-2024-34483 CVE-2024-51568 · GHSA-q2hv-8prh-hr3r

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in…

HIGH 79

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.47674 Published 2024-10-29 No fix listed CWE-78

TI-2024-34482 CVE-2024-51567 · GHSA-w6g2-qqv5-83qj

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6…

CRITICAL 100KEV

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMi…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.84402 Published 2024-10-29 No fix listed CWE-306

TI-2024-34345 CVE-2024-51378 · GHSA-c45f-33wq-x2qc

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before…

CRITICAL 100KEV

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatu…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.94748 Published 2024-10-29 No fix listed CWE-78

TI-2019-09780 CVE-2019-13056 · GHSA-p4j4-h6c2-mgj5

An issue was discovered in CyberPanel through 1.8.4.

MEDIUM 40

An issue was discovered in CyberPanel through 1.8.4.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00838 Published 2019-07-02 No fix listed CWE-352

Vulnerabilities

Filters