GCVE - cpe:2.3:a:usmannasir:cyberpanel:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:usmannasir:cyberpanel:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Usmannasir (`eeaa4c35-57f2-5822-9b35-9c19ffde3602`)
Product	Cyberpanel (`6e1d255e-b0dd-59d3-bd67-5ac506cc6fc2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-88895`	vulnerable	2026-09-16 04:34:09.179391	CyberPanel before 3.0.5 Authentication Bypass via API HIGH (7.2) CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor. Published: 2026-09-10T13:05:42.380Z Updated: 2026-09-11T19:22:51.358Z Open on db.gcve.eu Reference links https://github.com/usmannasir/cyberpanel/security/advisories/GHSA-h2f7-38ww-5pwc https://www.vulncheck.com/advisories/cyberpanel-before-3.0.5-authentication-bypass-via-api	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-87820`	vulnerable	2026-09-16 04:33:01.603464	db.gcve.eu details are currently unavailable. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-71966`	vulnerable	2026-09-16 04:32:59.461233	CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer HIGH (8.8) CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function. Published: 2026-08-10T18:53:12.324Z Updated: 2026-08-14T19:28:17.774Z Open on db.gcve.eu Reference links https://themcsam.github.io/posts/cyberpanel-2.4.3-vulnerabilties/ https://github.com/usmannasir/cyberpanel/commit/eca0c3cbeb35af8eaae9fafb094e8ef3cd923643 https://www.vulncheck.com/advisories/cyberpanel-authenticated-command-injection-via-starremotetransfer	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-71964`	vulnerable	2026-09-16 04:32:59.297192	CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload MEDIUM (6.5) CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface. Published: 2026-08-10T18:51:43.214Z Updated: 2026-08-14T16:51:51.661Z Open on db.gcve.eu Reference links https://themcsam.github.io/posts/cyberpanel-2.4.3-vulnerabilties/ https://github.com/usmannasir/cyberpanel/commit/eca0c3cbeb35af8eaae9fafb094e8ef3cd923643 https://www.vulncheck.com/advisories/cyberpanel-arbitrary-file-read-via-file-manager-zip-upload	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-71965`	vulnerable	2026-09-16 04:32:59.216939	CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature HIGH (8.8) CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public key retrieval process to write an attacker-controlled public key directly to /root/.ssh/authorized_keys, granting persistent root access to the host system. Published: 2026-08-10T18:52:40.271Z Updated: 2026-08-14T16:51:52.343Z Open on db.gcve.eu Reference links https://themcsam.github.io/posts/cyberpanel-2.4.3-vulnerabilties/ https://github.com/usmannasir/cyberpanel/commit/eca0c3cbeb35af8eaae9fafb094e8ef3cd923643 https://www.vulncheck.com/advisories/cyberpanel-authenticated-rce-via-remote-backup-feature	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-65917`	vulnerable	2026-07-29 01:06:20.269104	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-65916`	vulnerable	2026-07-29 01:06:20.268736	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-41473`	vulnerable	2026-06-08 08:03:15.429440	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-41472`	vulnerable	2026-06-08 08:03:15.428022	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Cyberpanel

Notes

PURL mappings

Vulnerability references

Contribute