Ispconfig

12 CVEs across 1 Ispconfig products. Browse Ispconfig vulnerabilities, severities, and proof-of-concept exploits.

Ispconfig products with known CVEs

ProductCVEs
Ispconfig12
Ispconfig CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-52206Medium4.72026-05-05ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.
CVE-2023-46818High7.22023-10-27An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is ena…
CVE-2021-3021Critical9.82021-01-05ISPConfig before 3.2.2 allows SQL injection.
CVE-2020-9398Critical9.82020-02-25ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
CVE-2013-3629High8.82020-02-07ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution
CVE-2012-2087Critical9.82020-01-23ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
CVE-2018-17984High7.82018-10-04An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploit…
CVE-2017-17384High8.82017-12-07ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
CVE-2015-41192015-06-15Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrat…
CVE-2015-41182015-06-15SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute a…
CVE-2006-30422006-06-15Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) go_info[isp][cl…
CVE-2006-23152006-05-12PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in th…