TI-2026-44091 CVE-2026-61518 · GHSA-m99h-35x2-cjq2
ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter
Priority HIGH 73
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API.
Vulnerabilities
13 records
TI-2025-32507 CVE-2025-52206 · GHSA-8vmq-hhfp-pr66
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.
Priority LOW 21
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.
TI-2023-25289 CVE-2023-46818 · GHSA-qfc7-gwmc-9vvr
An issue was discovered in ISPConfig before 3.2.11p1.
Priority HIGH 67
An issue was discovered in ISPConfig before 3.2.11p1.
TI-2021-02160 CVE-2021-3021 · GHSA-hm3v-rmvw-rq7w
ISPConfig before 3.2.2 allows SQL injection.
Priority MEDIUM 46
ISPConfig before 3.2.2 allows SQL injection.
TI-2020-07516 CVE-2020-9398 · GHSA-83jw-q574-9vc6
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option…
Priority MEDIUM 45
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
TI-2013-03171 CVE-2013-3629 · GHSA-hrjp-9g8g-g9qr
ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution
Priority HIGH 67
ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution
TI-2012-01860 CVE-2012-2087 · GHSA-j6w8-85rp-mrwv
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
Priority MEDIUM 47
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
TI-2018-12803 CVE-2018-17984 · GHSA-8h5j-7xvq-97fq
An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible…
Priority MEDIUM 40
An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution.
TI-2017-12708 CVE-2017-17384 · GHSA-4jgp-67cj-x7v5
ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
Priority MEDIUM 41
ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
TI-2015-03460 CVE-2015-4119 · GHSA-9965-949q-q7q9
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7…
Priority LOW 33
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a r…
TI-2015-03459 CVE-2015-4118 · GHSA-q3xp-wrf7-p8pf
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7…
Priority LOW 33
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter.
TI-2006-02946 CVE-2006-3042 · GHSA-cq4h-jg73-mw34
Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote…
Priority LOW 38
Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) go_info[isp][classes_root] parameter in (a) server.inc.php, and the (2) go_i…
TI-2006-02255 CVE-2006-2315 · GHSA-j629-vw9x-r3c2
PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier…
Priority MEDIUM 41
PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the go_info[server][classes_root] parameter.