control-webpanel vulnerabilities

Products

• webpanel 85

Latest control-webpanel CVEs

Newest publication first · page 1 of 4

1. CVE-2025-48703 CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A....

   Published 2025-09-19

   Critical·CVSS 9.0 EPSS 99.7% CISA KEV added 2025-11-04 Exploited in the wild

   CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

2. CVE-2023-42122 Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability

   Published 2024-05-03

   High·CVSS 7.8 EPSS 0.77%

   Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the t...

3. CVE-2023-42123 Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability

   Published 2024-05-03

   High·CVSS 8.8 EPSS 2.3%

   Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability. The specific flaw...

4. CVE-2023-42121 Control Web Panel Missing Authentication Remote Code Execution Vulnerability

   Published 2024-05-03

   Critical·CVSS 9.8 EPSS 1.8%

   Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is not required to exploit this vulnerability. The specific flaw exist...

5. CVE-2023-42120 Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability

   Published 2024-05-03

   High·CVSS 8.8 EPSS 2.6%

   Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability. The specific fla...

6. CVE-2022-44877 login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

   Published 2023-01-05

   Critical·CVSS 9.8 EPSS 100.0% CISA KEV added 2023-01-17 Exploited in the wild Framework module Public exploit

   login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

7. CVE-2021-45467 In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /us...

   Published 2022-12-26

   Critical·CVSS 9.8 EPSS 70.7%

   In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI...

8. CVE-2021-45466 In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.

   Published 2022-12-26

   Critical·CVSS 9.8 EPSS 55.3%

   In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.

9. CVE-2022-25048 Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.

   Published 2022-07-07

   High·CVSS 8.8 EPSS 19.8%

   Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.

10. CVE-2022-25047 The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.

    Published 2022-07-07

    Medium·CVSS 5.9 EPSS 2.0%

    The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.

11. CVE-2022-25046 A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.

    Published 2022-07-07

    Critical·CVSS 9.8 EPSS 57.4%

    A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.

12. CVE-2021-31316 The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.

    Published 2021-05-18

    Critical·CVSS 9.8 EPSS 13.3%

    The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.

13. CVE-2021-31324 The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.

    Published 2021-05-18

    Critical·CVSS 9.8 EPSS 34.6%

    The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.

14. CVE-2020-15628 This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerabili...

    Published 2020-07-28

    High·CVSS 7.5 EPSS 3.8%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the us...

15. CVE-2020-15627 This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerabili...

    Published 2020-07-28

    High·CVSS 7.5 EPSS 3.8%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the ac...

16. CVE-2020-15626 This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerabili...

    Published 2020-07-28

    High·CVSS 7.5 EPSS 3.8%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the term pa...

17. CVE-2020-15625 This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerabili...

    Published 2020-07-28

    High·CVSS 7.5 EPSS 3.8%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_add_mailbox.php. When parsing the usern...

18. CVE-2020-15624 This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerabili...

    Published 2020-07-28

    High·CVSS 7.5 EPSS 4.0%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_new_account.php. When parsing the domai...

19. CVE-2020-15623 This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The s...

    Published 2020-07-28

    Critical·CVSS 9.8 EPSS 8.3%

    This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo param...

20. CVE-2020-15622 This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerabili...

    Published 2020-07-28

    High·CVSS 7.5 EPSS 3.8%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the se...

21. CVE-2020-15621 This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerabili...

    Published 2020-07-28

    High·CVSS 7.5 EPSS 3.8%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mail_autoreply.php. When parsing the em...

22. CVE-2020-15620 This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerabili...

    Published 2020-07-28

    High·CVSS 7.5 EPSS 4.0%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the id...

23. CVE-2020-15619 This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerabili...

    Published 2020-07-28

    High·CVSS 7.5 EPSS 3.8%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the typ...

24. CVE-2020-15618 This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerabili...

    Published 2020-07-28

    High·CVSS 7.5 EPSS 3.8%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the use...

25. CVE-2020-15617 This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerabili...

    Published 2020-07-28

    High·CVSS 7.5 EPSS 3.8%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_list_accounts.php. When parsing the sta...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.