CVE-2025-48703 | Critical | 9.0 | 2025-09-19 | CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total paramete… |
CVE-2023-42123 | High | 8.8 | 2024-05-03 | Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2023-42122 | High | 7.8 | 2024-05-03 | Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affec… |
CVE-2023-42121 | Critical | 9.8 | 2024-05-03 | Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2023-42120 | High | 8.8 | 2024-05-03 | Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2022-44877 | Critical | 9.8 | 2023-01-05 | login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metac… |
CVE-2021-45467 | Critical | 9.8 | 2022-12-26 | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an ar… |
CVE-2021-45466 | Critical | 9.8 | 2022-12-26 | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_ke… |
CVE-2022-25048 | High | 8.8 | 2022-07-07 | Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user. |
CVE-2022-25047 | Medium | 5.9 | 2022-07-07 | The password reset token in CWP v0.9.8.1126 is generated using known or predictable values. |
CVE-2022-25046 | Critical | 9.8 | 2022-07-07 | A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2021-31324 | Critical | 9.8 | 2021-05-18 | The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. |
CVE-2021-31316 | Critical | 9.8 | 2021-05-18 | The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter. |
CVE-2020-15628 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15627 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15626 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15625 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15624 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15623 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not requ… |
CVE-2020-15622 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15621 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15620 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15619 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15618 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15617 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15616 | High | 7.5 | 2020-07-28 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is… |
CVE-2020-15615 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15614 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15613 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15612 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15611 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15610 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15608 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15607 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15606 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15435 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15434 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15433 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15432 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15431 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15430 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15429 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15428 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15427 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15426 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15425 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15424 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15423 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15422 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15421 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not req… |
CVE-2020-15420 | Critical | 9.8 | 2020-07-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. Authentication is not req… |
CVE-2020-10230 | Critical | 9.8 | 2020-03-16 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php term parameter. |
CVE-2019-15235 | Medium | 6.5 | 2019-12-17 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx… |
CVE-2019-14782 | Medium | 6.5 | 2019-12-17 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and… |
CVE-2019-16295 | Medium | 4.6 | 2019-10-31 | Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter. This can be exploited by a local a… |
CVE-2019-14725 | Medium | 4.3 | 2019-09-11 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim accou… |
CVE-2019-14724 | High | 7.5 | 2019-09-11 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a vict… |
CVE-2019-14730 | Medium | 4.3 | 2019-09-10 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a victim's account via an… |
CVE-2019-14729 | Medium | 4.3 | 2019-09-10 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a victim's account via… |
CVE-2019-14728 | Medium | 4.3 | 2019-09-10 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding destination to a victi… |
CVE-2019-14727 | Medium | 4.3 | 2019-09-10 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password of a victim account… |
CVE-2019-14726 | Medium | 5.4 | 2019-09-10 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS records of a victim's acc… |
CVE-2019-14723 | Medium | 4.3 | 2019-09-10 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacke… |
CVE-2019-14722 | Medium | 4.3 | 2019-09-10 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding destination from a… |
CVE-2019-14721 | Medium | 6.5 | 2019-09-10 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an att… |
CVE-2019-13476 | Medium | 5.4 | 2019-08-21 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list… |
CVE-2019-13599 | Medium | 5.3 | 2019-08-21 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response time… |
CVE-2019-13477 | High | 8.8 | 2019-08-21 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root accoun… |
CVE-2019-13387 | Medium | 6.1 | 2019-07-26 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or… |
CVE-2019-13385 | Medium | 4.3 | 2019-07-26 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and che… |
CVE-2019-13359 | High | 7.5 | 2019-07-16 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory… |
CVE-2019-13605 | High | 8.8 | 2019-07-16 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the kno… |
CVE-2019-13383 | Medium | 5.3 | 2019-07-16 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP respon… |
CVE-2019-13360 | Critical | 9.8 | 2019-07-16 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid… |
CVE-2019-12190 | Medium | 5.4 | 2019-05-21 | XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter. |
CVE-2019-11429 | Medium | 4.8 | 2019-05-13 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the… |
CVE-2019-7646 | Medium | 4.8 | 2019-03-26 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via the add_package module… |
CVE-2018-18774 | Medium | 6.1 | 2018-11-20 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter. |
CVE-2018-18773 | High | 8.8 | 2018-11-20 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password. |
CVE-2018-18772 | High | 8.8 | 2018-11-20 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS… |
CVE-2018-18324 | Medium | 6.1 | 2018-10-15 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, servic… |
CVE-2018-18323 | High | 7.5 | 2018-10-15 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&file=/../… |
CVE-2018-18322 | Critical | 9.8 | 2018-10-15 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start, service_restart… |
CVE-2018-5962 | Medium | 6.1 | 2018-01-22 | index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address par… |
CVE-2018-5961 | Medium | 6.1 | 2018-01-22 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file. |