Approved changes feed: RSS · Atom
cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Control Webpanel (3d61e022-bd40-5c1f-9d78-0c52e5ce5272) |
|---|---|
| Product | Webpanel (2e729440-b973-55b7-97c0-8a313d6c8d51) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-48703 |
vulnerable | 2026-06-08 07:27:16.323926 |
Details available
CRITICAL (9)
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
Published: 2025-09-19T00:00:00.000Z
Updated: 2026-02-26T17:48:25.658Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-44877 |
vulnerable | 2026-06-08 05:50:35.011824 |
Details available
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
Published: 2023-01-05T00:00:00.000Z
Updated: 2025-10-21T23:15:28.941Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25046 |
vulnerable | 2026-06-08 05:41:45.128311 |
Details available
A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.
Published: 2022-07-07T11:28:59.000Z
Updated: 2024-08-03T04:29:01.662Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-45467 |
vulnerable | 2026-06-08 05:36:48.196186 |
Details available
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter.
Published: 2022-12-26T00:00:00.000Z
Updated: 2025-04-12T00:06:13.609Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-45466 |
vulnerable | 2026-06-08 05:36:48.195668 |
Details available
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.
Published: 2022-12-26T00:00:00.000Z
Updated: 2025-04-14T15:45:40.679Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-7646 |
vulnerable | 2026-06-08 05:14:14.625347 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-15235 |
vulnerable | 2026-06-08 05:12:56.829574 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-14782 |
vulnerable | 2026-06-08 05:12:56.004114 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12190 |
vulnerable | 2026-06-08 05:12:38.676966 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-5962 |
vulnerable | 2026-06-08 05:11:53.148907 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-5961 |
vulnerable | 2026-06-08 05:11:53.148544 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-18774 |
vulnerable | 2026-06-08 05:11:14.677781 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-18773 |
vulnerable | 2026-06-08 05:11:14.677390 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-18772 |
vulnerable | 2026-06-08 05:11:14.676850 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.