GCVE - cpe:2.3:a:ispconfig:ispconfig:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ispconfig:ispconfig:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Ispconfig (`7a9664cb-64e6-5b89-87b2-8164236e871f`)
Product	Ispconfig (`491f2ce3-3526-59cc-a508-837dcf07d2e8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-46818`	vulnerable	2026-06-08 06:14:23.487215	Details available An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled. Published: 2023-10-27T00:00:00.000Z Updated: 2024-10-11T17:06:17.464Z Open on db.gcve.eu Reference links https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/ http://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html http://seclists.org/fulldisclosure/2023/Dec/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-3021`	vulnerable	2026-06-08 05:33:50.672858	Details available ISPConfig before 3.2.2 allows SQL injection. Published: 2021-01-05T15:47:02.000Z Updated: 2024-08-03T16:45:50.980Z Open on db.gcve.eu Reference links https://www.ispconfig.org/blog/ispconfig-3-2-2-released-important-security-update/ https://twitter.com/ispconfig/status/1346142615511724032	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-9398`	vulnerable	2026-06-08 05:28:01.538290	Details available ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection. Published: 2020-02-25T20:23:55.000Z Updated: 2024-08-04T10:26:16.127Z Open on db.gcve.eu Reference links https://www.ispconfig.org/blog/ispconfig-3-1-15p3-released-security-bugfix-release/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-17984`	vulnerable	2026-06-08 05:11:07.082556	Details available An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access. Published: 2018-10-04T23:00:00.000Z Updated: 2024-08-05T11:01:14.833Z Open on db.gcve.eu Reference links https://www.ispconfig.org/blog/ispconfig-3-1-13-released-important-security-bugfix/ https://0x09al.github.io/security/ispconfig/exploit/vulnerability/2018/08/20/bug-or-backdoor-ispconfig-rce.html https://github.com/0x09AL/0x09al.github.io/blob/master/_posts/2018-08-20-bug-or-backdoor-ispconfig-rce.markdown	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-3629`	vulnerable	2026-06-08 05:04:32.367305	Details available ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution Published: 2020-02-07T14:25:36.000Z Updated: 2024-08-06T16:14:56.569Z Open on db.gcve.eu Reference links https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-foss-disclosures-part-one http://www.securityfocus.com/bid/63455 http://www.exploit-db.com/exploits/29322	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2087`	vulnerable	2026-06-08 05:00:52.756834	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-2315`	vulnerable	2026-06-08 04:49:06.296202	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Ispconfig

Notes

PURL mappings

Vulnerability references

Contribute