Vulnerabilities

TI-2025-30935 CVE-2025-48703 · GHSA-vx2w-cj7g-8hcf

OS command injection in CentOS Web Panel

CRITICAL 98KEV

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.99655 Published 2025-09-19 Fixed in 0.9.8.1205 CWE-78

TI-2023-22491 CVE-2023-42123 · GHSA-vj52-239v-8h2j

OS command injection in Control Web Panel

MEDIUM 44

Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02307 Published 2024-05-03 No fix listed CWE-78

TI-2023-22490 CVE-2023-42122 · GHSA-wx6x-wf29-2wrc

OS command injection in Control Web Panel

LOW 37

Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00767 Published 2024-05-03 No fix listed CWE-78

TI-2023-22489 CVE-2023-42121 · GHSA-m2qh-hm8j-fx8m

Missing authentication in Control Web Panel

MEDIUM 53

Control Web Panel Missing Authentication Remote Code Execution Vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01839 Published 2024-05-03 No fix listed CWE-306

TI-2023-22488 CVE-2023-42120 · GHSA-3cxr-mgrx-fg7c

OS command injection in Control Web Panel

MEDIUM 45

Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0263 Published 2024-05-03 No fix listed CWE-78

TI-2022-22082 CVE-2022-44877 · GHSA-fxw7-8r5q-w2v4

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147…

CRITICAL 100KEV

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99995 Published 2023-01-05 No fix listed CWE-78

TI-2021-20554 CVE-2021-45467 · GHSA-4xcw-rcp3-wq4p

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated…

CRITICAL 86

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.70745 Published 2022-12-26 No fix listed CWE-862

TI-2021-20553 CVE-2021-45466 · GHSA-cmwh-95wf-h584

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make…

HIGH 82

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.55338 Published 2022-12-26 No fix listed CWE-863

TI-2022-08813 CVE-2022-25048 · GHSA-6pc6-c32g-9g4q

Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.

MEDIUM 57

Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.19826 Published 2022-07-07 No fix listed CWE-78

TI-2022-08812 CVE-2022-25047 · GHSA-pqrx-8f89-682j

The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.

LOW 30

The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02033 Published 2022-07-07 No fix listed CWE-330

TI-2022-08811 CVE-2022-25046 · GHSA-5jpv-ccxq-q87r

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to…

HIGH 76

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.57435 Published 2022-07-07 No fix listed CWE-22

TI-2021-11468 CVE-2021-31316 · GHSA-jf3r-qxgj-64p2

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via…

MEDIUM 57

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.13272 Published 2021-05-18 No fix listed CWE-89

TI-2021-11476 CVE-2021-31324 · GHSA-3jr9-r246-qqvc

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection…

HIGH 67

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.34619 Published 2021-05-18 No fix listed CWE-78

TI-2020-12303 CVE-2020-15628 · GHSA-whvm-7q6x-qjfp

SQL injection in CentOS Web Panel

LOW 39

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0383 Published 2020-07-28 No fix listed CWE-89

TI-2020-12302 CVE-2020-15627 · GHSA-5f52-jr7w-7384

SQL injection in CentOS Web Panel

LOW 39

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0383 Published 2020-07-28 No fix listed CWE-89

TI-2020-12301 CVE-2020-15626 · GHSA-vqp6-6prp-hrc9

SQL injection in CentOS Web Panel

LOW 39

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0383 Published 2020-07-28 No fix listed CWE-89

TI-2020-12300 CVE-2020-15625 · GHSA-cp9p-hq5q-j2j2

SQL injection in CentOS Web Panel

LOW 39

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0383 Published 2020-07-28 No fix listed CWE-89

TI-2020-12299 CVE-2020-15624 · GHSA-vhvc-pw37-prxw

SQL injection in CentOS Web Panel

MEDIUM 40

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0401 Published 2020-07-28 No fix listed CWE-89

TI-2020-12298 CVE-2020-15623 · GHSA-4hcf-cp54-4wwx

This vulnerability allows remote attackers to write arbitrary files on affected…

MEDIUM 53

This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08335 Published 2020-07-28 No fix listed CWE-749

TI-2020-12297 CVE-2020-15622 · GHSA-cv7h-xc33-h73c

SQL injection in CentOS Web Panel

LOW 39

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0383 Published 2020-07-28 No fix listed CWE-89

TI-2020-12296 CVE-2020-15621 · GHSA-rwv9-24r7-rj8v

SQL injection in CentOS Web Panel

LOW 39

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0383 Published 2020-07-28 No fix listed CWE-89

TI-2020-12295 CVE-2020-15620 · GHSA-4qvr-wj3w-84g9

SQL injection in CentOS Web Panel

MEDIUM 40

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0401 Published 2020-07-28 No fix listed CWE-89

TI-2020-12294 CVE-2020-15619 · GHSA-4hvx-mf9f-fvm7

SQL injection in CentOS Web Panel

LOW 39

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0383 Published 2020-07-28 No fix listed CWE-89

TI-2020-12293 CVE-2020-15618 · GHSA-m78r-2xpj-hgv8

SQL injection in CentOS Web Panel

LOW 39

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0383 Published 2020-07-28 No fix listed CWE-89

TI-2020-12292 CVE-2020-15617 · GHSA-jvxx-p9c4-49vp

SQL injection in CentOS Web Panel

LOW 39

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0383 Published 2020-07-28 No fix listed CWE-89

Vulnerabilities

Filters