Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Jan 15, 2026DPanel is an open source server management panel written in Go.CVE-2025-66292 · Other software · donknap · reported by GitHubHigh 8.1
DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.
- Product
- dpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1.CVE-2025-15241 · Other software · CloudPanel · reported by VulDBLow 2
A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1. The affected element is an unknown function of the file /admin/users of the component HTTP Header Handler. Such manipulation of the argument Referer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.5.2 is sufficient to fix this issue. Upgrading the affected component is recommended.
- Product
- Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2025dpanel is an open source server management panel written in Go.CVE-2025-53363 · Other software · donknap · reported by GitHubMedium 4.8
dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from the server via the /api/app/compose/get-from-uri API endpoint. The vulnerability exists in the GetFromUri function in app/application/http/controller/compose.go, where the uri parameter is passed directly to os.ReadFile without proper validation or access control. A logged-in attacker can exploit this flaw to read sensitive files from the host system, leading to information disclosure. No patched version is available as of this writing.
- Product
- dpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Dpanel is a Docker visualization panel system which provides complete Docker management functions.CVE-2025-30206 · Other software · donknap · reported by GitHubCritical 9.8
Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. This security flaw allows attackers to analyze the source code, discover the embedded secret, and craft legitimate JWT tokens. By forging these tokens, an attacker can successfully bypass authentication mechanisms, impersonate privileged users, and gain unauthorized administrative access. Consequently, this enables full control over the host machine, potentially leading to severe consequences such as sensitive data exposure, unauthorized command execution, privilege escalation, or further lateral movement within the network environment. This issue is patched in version 1.6.1. A workaround for this vulnerability involves replacing the hardcoded secret with a securely generated value and load it from secure configuration storage.
- Product
- dpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass CVE-2024-44765 · Other software · mgt-commerce · reported by MITREMedium 6.5
An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.
- Product
- cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information and execute arbitraryCVE-2024-24320 · Other software · mgt-commerce · reported by MITREHigh 8.8
Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information and execute arbitrary code via the service parameter of the load-logfiles function.
- Product
- cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and changing fileCVE-2023-46157 · Other software · Mgt-commerce · reported by MITREHigh 8.8
File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and changing file permissions to 4755.
- Product
- Cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudpanel.iomgt-commerce.com
Jun 25, 2023In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.CVE-2023-36630 · Other software · Mgt-commerce · reported by MITREHigh 8.8
In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.
- Product
- Cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcloudpanel.io
Jun 20, 2023CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.CVE-2023-35885 · Other software · Mgt-commerce · reported by MITRECritical 9.8
CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
- Product
- Cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcloudpanel.io
Jun 6, 2023CloudPanel v2.2.2 allows attackers to execute a path traversal.CVE-2023-33747 · Other software · Mgt-commerce · reported by MITREHigh 7.8
CloudPanel v2.2.2 allows attackers to execute a path traversal.
- Product
- Cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcwe.mitre.org
Mar 21, 2023MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudCVE-2023-0391 · Other software · MGT-COMMERCE · reported by cve@rapid7.comHigh 8.1
MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudPanel. This behavior was observed in version 2.2.0. There has been no indication from the vendor this has been addressed in version 2.2.1.
- Product
- CloudPanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbleepingcomputer.comrapid7.com
Jul 22, 2010Directory traversal vulnerability in loadpanel.php in Interspire ActiveKB allows remote attackers to read arbitrary files and possibly have unspecified other imCVE-2009-4957 · Other software · Interspire · reported by MITREHigh 7.5
Directory traversal vulnerability in loadpanel.php in Interspire ActiveKB allows remote attackers to read arbitrary files and possibly have unspecified other impact via directory traversal sequences in the Panel parameter.
- Product
- Activekb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.