Vesta Control Panel
Approved changes feed: RSS · Atom
cpe:2.3:a:vestacp:vesta_control_panel:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Vestacp (52e26e99-10ff-59d2-bc96-7f23b1487690) |
|---|---|
| Product | Vesta Control Panel (45a96d28-d0e7-518e-8d3b-710763f5456f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/serghey-rodin/vesta |
purl2cpe | 2026-06-01 10:18:05.577219 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-47873 |
vulnerable | 2026-06-08 05:38:07.824881 |
VestaCP < 0.9.8-25 - Stored Cross-Site Scripting
HIGH (7.2)
VestaCP versions prior to 0.9.8-25 contain a cross-site scripting vulnerability in the IP interface configuration that allows attackers to inject malicious scripts. Attackers can exploit the 'v_interface' parameter by sending a crafted POST request to the add/ip/ endpoint with a stored XSS payload.
Published: 2026-01-21T17:27:48.296Z
Updated: 2026-03-05T01:29:04.125Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-46850 |
vulnerable | 2026-06-08 05:38:06.207956 |
Details available
myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.
Published: 2022-10-24T00:00:00.000Z
Updated: 2025-05-07T14:29:33.754Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-30462 |
vulnerable | 2026-06-08 05:31:51.033653 |
Details available
VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts.
Published: 2021-04-08T13:54:15.000Z
Updated: 2024-08-03T22:32:40.887Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-28379 |
vulnerable | 2026-06-08 05:31:24.158411 |
Details available
web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.
Published: 2021-03-15T05:56:46.000Z
Updated: 2024-08-03T21:40:14.233Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-10808 |
vulnerable | 2026-06-08 05:16:35.915862 |
Details available
Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters.
Published: 2020-03-22T16:07:34.000Z
Updated: 2024-08-04T11:14:15.591Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-10787 |
vulnerable | 2026-06-08 05:16:35.890686 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-10786 |
vulnerable | 2026-06-08 05:16:35.890293 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-9859 |
vulnerable | 2026-06-08 05:14:26.335002 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1000884 |
vulnerable | 2026-06-08 05:10:26.184943 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-2861 |
vulnerable | 2026-06-08 05:06:36.067478 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.