Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,914 results · page 8 of 39
Jan 28, 2026LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel.CVE-2020-36993 · Other software · Limesurvey · reported by VulnCheckMedium 5.1
LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel. Attackers can inject malicious SVG scripts through the Surveymenu[title] and Surveymenu[parent_id] parameters to execute arbitrary JavaScript in administrative contexts.
- Product
- LimeSurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 27, 2026Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields.CVE-2020-36978 · Other software · Froxlor · reported by VulnCheckMedium 5.1
Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject malicious scripts through username, name, and firstname parameters to execute code when administrators view customer traffic modules.
- Product
- Froxlor Froxlor Server Management Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfroxlor.orgfroxlor.org
Jan 21, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-24042 · Other software · appsmithorg · reported by GitHubCritical 9.4
Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished (edit-mode) actions by sending viewMode=false (or omitting it) to POST /api/v1/actions/execute. This bypasses the expected publish boundary where public viewers should only execute published actions, not edit-mode versions. An attack can result in sensitive data exposure, execution of edit‑mode queries and APIs, development data access, and the ability to trigger side effect behavior. This issue does not have a released fix at the time of publication.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authenticated attackers to manipulate databaseCVE-2021-47872 · Other software · SEO Panel · reported by VulnCheckHigh 7
SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authenticated attackers to manipulate database queries through the 'order_col' parameter. Attackers can use sqlmap to exploit the vulnerability and extract database information by injecting malicious SQL code into the order column parameter.
- Product
- SEO Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the APCVE-2021-47871 · Other software · Hestia Control Panel · reported by VulnCheckHigh 8.6
Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the API index.php endpoint. Attackers can exploit the v-make-tmp-file command to write SSH keys or other content to specific file paths on the server.
- Product
- Hestia Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhestiacp.com
Jan 19, 2026Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.CVE-2026-21696 · Other software · pterodactyl · reported by GitHubHigh 8.3
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records. After Wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the max parameter limit of SQLite, 32766 as of SQLite 3.32.0. If wings attempts to delete more than 32766 entries from the SQLite database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not remove any entries from the database. These entries are then indefinitely re-processed and resent to the panel each time the cron runs. By successfully exploiting this vulnerability, an attacker can trigger a situation where wings will keep uploading the same activity data to the panel repeatedly (growing each time to include new activity) until the panels' database server runs out of disk space. Version 1.12.0 fixes the issue.
- Product
- wings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.CVE-2025-69199 · Other software · pterodactyl · reported by GitHubHigh 8.3
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an excessive volume of data over the network and overloading the host system memory and cpu. Additionally, there is not a limit applied to the total size of messages being sent or received, allowing a malicious user to open thousands of websocket connections and then send massive volumes of information over the socket, overloading the host network, and causing increased CPU and memory load within Wings. Version 1.12.0 patches the issue.
- Product
- panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Pterodactyl is a free, open-source game server management panel.CVE-2025-69198 · Other software · pterodactyl · reported by GitHubMedium 6
Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocations, or backups) that can exist for an individual server. These resource limits are applied on a per-server basis, and validated during the request cycle. However, in versions prior to 1.12.0, it is possible for a malicious user to send a massive volume of requests at the same time that would create more resources than the server is allotted. This is because the validation occurs early in the request cycle and does not lock the target resource while it is processing. As a result sending a large volume of requests at the same time would lead all of those requests to validate as not using any of the target resources, and then all creating the resources at the same time. As a result a server would be able to create more databases, allocations, or backups than configured. A malicious user is able to deny resources to other users on the system, and may be able to excessively consume the limited allocations for a node, or fill up backup space faster than is allowed by the system. Version 1.12.0 fixes the issue.
- Product
- panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 20261Panel is an open-source, web-based control panel for Linux server management.CVE-2026-23525 · Other software · 1Panel-dev · reported by GitHubMedium 6.4
1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel App Store when viewing application details. Malicious scripts can execute in the context of the user’s browser, potentially compromising session data or sensitive system interfaces. All versions of 1Panel up to and including v1.10.33-lts and v2.0.16 are affected. An attacker could publish a malicious application that, when loaded by users (locally or remotely), can execute arbitrary scripts. This may result in theft of user cookies, unauthorized access to system functions, or other actions that compromise the confidentiality, integrity, and availability of the system. The vulnerability is caused by insufficient sanitization of content rendered by the MdEditor component with the `previewOnly` attribute enabled. Specifically, the App Store renders application README content without proper XSS protection, allowing script execution during content rendering; and similar issues exist in system upgrade-related components, which can be fixed by implementing proper XSS sanitization in the MdEditor component. These vulnerabilities can be mitiga
- Product
- 1Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands thrCVE-2021-47816 · Other software · Thecus · reported by VulnCheckMedium 5.3
Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands through user management endpoints. Attackers can inject commands via username and batch user creation parameters to execute shell commands with administrative privileges.
- Product
- Thecus N4800Eco Nas Server Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter.CVE-2021-47808 · Other software · cotonti.com · reported by VulnCheckMedium 5.1
Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code through the 'maintitle' parameter to execute scripts when administrators view the page.
- Product
- Cotonti Siena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcotonti.comcotonti.com
Jan 15, 2026DPanel is an open source server management panel written in Go.CVE-2025-66292 · Other software · donknap · reported by GitHubHigh 8.1
DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.
- Product
- dpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel.CVE-2022-50936 · Other software · Wbce · reported by VulnCheckHigh 8.7
WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel. Authenticated attackers can exploit the droplet upload functionality in the admin tools to create and execute arbitrary PHP code by crafting a specially designed zip file payload.
- Product
- WBCE CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbiCVE-2022-50909 · Other software · Algo Solutions · reported by VulnCheckHigh 8.6
Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbitrary commands. Attackers can exploit the insecure 'source' parameter by injecting commands that are executed with root privileges, enabling remote code execution through a crafted POST request.
- Product
- Algo 8028
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalgosolutions.comalgosolutions.com
Jan 12, 2026Appsmith is a platform to build admin panels, internal tools, and dashboards.CVE-2026-22794 · Other software · appsmithorg · reported by GitHubCritical 9.6
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin value from the request headers as the email link baseUrl without validation. If an attacker controls the Origin, password reset / email verification links in emails can be generated pointing to the attacker’s domain, causing authentication tokens to be exposed and potentially leading to account takeover. This vulnerability is fixed in 1.93.
- Product
- appsmith
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Pterodactyl is a free, open-source game server management panel.CVE-2025-69197 · Other software · pterodactyl · reported by GitHubMedium 6.5
Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.
- Product
- panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026Pterodactyl is a free, open-source game server management panel.CVE-2025-68954 · Other software · pterodactyl · reported by GitHubHigh 7.5
Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.
- Product
- panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1.CVE-2025-15241 · Other software · CloudPanel · reported by VulDBLow 2
A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1. The affected element is an unknown function of the file /admin/users of the component HTTP Header Handler. Such manipulation of the argument Referer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.5.2 is sufficient to fix this issue. Upgrading the affected component is recommended.
- Product
- Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF file.CVE-2025-57462 · Other software · Machsol · reported by MITREMedium 6.1
Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF file.
- Product
- Machpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2025File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.CVE-2025-57460 · Other software · Machsol · reported by MITRECritical 9.8
File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.
- Product
- Machpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025FLIR AX8 Thermal Camera 1.32.16 contains hard-coded SSH and web panel credentials that cannot be changed through normal camera operations.CVE-2018-25138 · Other software · FLIR Systems · reported by VulnCheckCritical 9.3
FLIR AX8 Thermal Camera 1.32.16 contains hard-coded SSH and web panel credentials that cannot be changed through normal camera operations. Attackers can exploit these persistent credentials to gain unauthorized shell access and login to multiple camera interfaces using predefined username and password combinations.
- Product
- FLIR AX8 Thermal Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comflir.com
Dec 24, 2025An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL.CVE-2025-60935 · Other software · Returnfi · reported by MITREMedium 6.1
An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This issue affects the next_url parameter in the login endpoint and could lead to phishing or token theft after successful authentication.
- Product
- Blitz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 24, 2025In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure In case mipi_dsi_attacCVE-2022-50750 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure In case mipi_dsi_attach() fails, call drm_panel_remove() to avoid memory leak.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 22, 2025Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a themCVE-2025-67436 · Other software · Pluxml · reported by MITREMedium 6.5
Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).
- Product
- Pluxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2025Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuratiCVE-2025-61740 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.2
Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.
- Product
- IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 22, 2025Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.CVE-2025-26379 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.2
Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.
- Product
- IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 22, 2025Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.CVE-2025-61739 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.2
Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.
- Product
- IQ Panels2, 2+, IQHub, IQPanel 4, PowerG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 22, 2025Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network.CVE-2025-61738 · Other software · Johnson Controls · reported by productsecurity@jci.comLow 2.3
Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network.
- Product
- IQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 18, 2025Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login.CVE-2025-64400 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 4.1
Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesting a user creation has `edit` on the enrollment-level user directory, but is missing a separate check that the enrollment editor has access (or belongs to) the organization that they are adding a user to.
- Product
- com.palantir.controlpanel:control-panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025MaxKB is an open-source AI assistant for enterprise.CVE-2025-66446 · Other software · 1Panel-dev · reported by GitHubHigh 8.8
MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escalation. This issue is fixed in version 2.4.0.
- Product
- MaxKB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025MaxKB is an open-source AI assistant for enterprise.CVE-2025-66419 · Other software · 1Panel-dev · reported by GitHubHigh 8.8
MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and escalate privileges under certain concurrent conditions. This issue is fixed in version 2.4.0.
- Product
- MaxKB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2025CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripCVE-2024-58296 · Other software · PhoenixCart · reported by VulnCheckMedium 5.3
CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page.
- Product
- CE Phoenix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddemos6.softaculous.comphoenixcart.org
Dec 11, 2025An issue was discovered in cPanel 110 through 132.CVE-2025-66429 · Websites & servers · reported by MITREHigh 8.8
An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cpanel.netdocs.cpanel.net
Dec 10, 20251Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality.CVE-2025-34430 · Other software · LXware · reported by VulnCheckMedium 5.1
1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a panel-name change request; if a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows a remote attacker to change the victim’s panel name to an arbitrary value without consent.
- Product
- 1Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 20251Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality.CVE-2025-34429 · Other software · LXware · reported by VulnCheckHigh 7
1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a port-change request; when a victim visits it while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the port on which the 1Panel web service listens, causing loss of access on the original port and resulting in service disruption or denial of service, and may unintentionally expose the service on an attacker-chosen port.
- Product
- 1Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 20251Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings paneCVE-2025-34410 · Other software · LXware · reported by VulnCheckHigh 7
1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel). The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a username-change request; when a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the victim’s 1Panel username without consent. After the change, the victim is logged out and unable to log in with the previous username, resulting in account lockout and denial of service.
- Product
- 1Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 20251Panel is an open-source, web-based control panel for Linux server management.CVE-2025-66508 · Other software · 1Panel-dev · reported by GitHubMedium 6.5
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls (AllowIPs, API whitelists, localhost-only checks) rely on ClientIP(), attackers can bypass these protections by simply sending X-Forwarded-For: 127.0.0.1 or any whitelisted IP. This renders all IP-based security controls ineffective. This issue is fixed in version 2.0.14.
- Product
- 1Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 20251Panel is an open-source, web-based control panel for Linux server management.CVE-2025-66507 · Other software · 1Panel-dev · reported by GitHubHigh 7.5
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections can be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). This issue is fixed in version 2.0.14.
- Product
- 1Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Spoofing issue in the Downloads Panel component.CVE-2025-14327 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 26, 2025The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a malicious aCVE-2024-5540 · Other software · Automated Logic · reported by productsecurity@carrier.comMedium 6.9
The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a malicious actor to compromise the client browser .
- Product
- WebCTRL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.phCVE-2025-65236 · Other software · Opencode · reported by MITRECritical 9.8
OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.
- Product
- Ussd Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeslam3kl.gitbook.ioeslam3kl.gitbook.io
Nov 18, 2025kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic.CVE-2025-63512 · Other software · Kishan0725 · reported by MITREMedium 6.5
kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic. The application fails to properly sanitize or parameterize user-supplied input from the demail parameter before incorporating it directly into a dynamic SQL query.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025Download Panel: Unauthorized settings modificationCVE-2025-12961 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Panel plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check on the 'wp_ajax_save_settings' AJAX action in all versions up to, and including, 1.3.3. This is due to the absence of any capability verification in the `dlpn_save_settings()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to arbitrarily modify plugin settings including display text, download links, button colors, and other visual customizations.
- Product
- Download Panel
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Download Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 13, 2025MaxKB is an open-source AI assistant for enterprise.CVE-2025-64703 · Other software · 1Panel-dev · reported by GitHubMedium 6.3
MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although the process run in sandbox. Version 2.3.1 fixes the issue.
- Product
- MaxKB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025MaxKB is an open-source AI assistant for enterprise.CVE-2025-64511 · Other software · 1Panel-dev · reported by GitHubHigh 7.4
MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can access internal network services such as databases through Python code in the tool module, although the process runs in a sandbox. Version 2.3.1 fixes the issue.
- Product
- MaxKB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.CVE-2025-64281 · Other software · Centralsquare · reported by MITRECritical 9.8
An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.
- Product
- Community Development
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcentralsquare.commachevalia.blog
Nov 8, 2025A vulnerability has been found in aaPanel BaoTa up to 11.2.x.CVE-2025-12914 · Other software · aaPanel · reported by VulDBLow 2
A vulnerability has been found in aaPanel BaoTa up to 11.2.x. This vulnerability affects unknown code of the file /database?action=GetDatabaseAccess of the component Backend. The manipulation of the argument Name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.3.0 is able to resolve this issue. It is recommended to upgrade the affected component.
- Product
- BaoTa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML executCVE-2025-63420 · Other software · Crushftp · reported by MITREMedium 4.1
CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions.
- Product
- Crushftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 5, 2025PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component.CVE-2025-63334 · Other software · Magdesign · reported by MITRECritical 9.8
PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The application fails to sanitize user input in the opacityValue POST parameter before passing it to a shell command, allowing remote attackers to execute arbitrary commands with root privileges on the underlying system.
- Product
- Pocketvj Control Panel Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 5, 2025Multiple Roboticsware products provided by Roboticsware PTE.CVE-2025-64151 · Other software · Roboticsware PTE. LTD. · reported by vultures@jpcert.or.jpHigh 8.4
Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
- Product
- FA-Panel6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jproboticsware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.