U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:control-webpanel:webpanel:0.9.4:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 11 matching records.
Displaying matches 1 through 11.
Vuln ID Summary CVSS Severity
CVE-2022-44877

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

Published: January 05, 2023; 6:15:09 PM -0500 		V3.1: 9.8 CRITICAL
 V2.0:(not available)
CVE-2021-45467

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter.

Published: December 26, 2022; 12:15:10 AM -0500 		V3.1: 9.8 CRITICAL
 V2.0:(not available)
CVE-2021-45466

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.

Published: December 26, 2022; 12:15:10 AM -0500 		V3.1: 9.8 CRITICAL
 V2.0:(not available)
CVE-2022-25046

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.

Published: July 07, 2022; 8:15:09 AM -0400 		V3.1: 9.8 CRITICAL
 V2.0: 10.0 HIGH
CVE-2019-12190

XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter.

Published: May 21, 2019; 2:29:00 PM -0400 		V3.0: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2019-7646

CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via the add_package module parameter.

Published: March 26, 2019; 12:29:01 PM -0400 		V3.0: 4.8 MEDIUM
 V2.0: 3.5 LOW
CVE-2018-18774

CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter.

Published: November 20, 2018; 2:29:01 PM -0500 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2018-18773

CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password.

Published: November 20, 2018; 2:29:01 PM -0500 		V3.0: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2018-18772

CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command.

Published: November 20, 2018; 2:29:01 PM -0500 		V3.0: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2018-5962

index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address parameter to the mail_add-new module.

Published: January 21, 2018; 8:29:00 PM -0500 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2018-5961

CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file.

Published: January 21, 2018; 8:29:00 PM -0500 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM