Login Request a demo
WE
Product
Webpanel
by Control-webpanel · last CVE Sep 19, 2025
On CISA KEVExploited in the wild
85
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities85In the news0Timeline
Severity mix
Critical 37High 23Medium 25Low 0
Severity
All severities85Critical37High23Medium25Low0
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add Webpanel to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2019-15235
6.5
1%
Dec 17
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, and the victim's…
Affected: 0.9.8.856 through 0.9.8.864
CVE-2019-14782
6.5
1%
Dec 17
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and the victim's token…
Affected: 0.9.8.856 through 0.9.8.864
CVE-2019-14721
6.5
2%
Sep 10
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attacker account
Affected: 0.9.8.851
CVE-2019-13387
6.1
2%
Jul 26
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or session, or…
Affected: 0.9.8.846
CVE-2018-18774
6.1
5%
Nov 20
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter
Affected: through 0.9.8.740
CVE-2018-18324
6.1
3%
Oct 15
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start,…
Affected: 0.9.8.480
CVE-2018-5962
6.1
3%
Jan 22
index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address parameter to the…
Affected: through 0.9.8.12
CVE-2018-5961
6.1
3%
Jan 22
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file
Affected: through 0.9.8.12
CVE-2022-25047
5.9
2%
Jul 7
The password reset token in CWP v0.9.8.1126 is generated using known or predictable values
Affected: 0.9.8.1126
CVE-2019-14726
5.4
1%
Sep 10
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS records of a victim's account via an attacker…
Affected: 0.9.8.851
CVE-2019-13476
5.4
7%
Aug 21
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page
Affected: 0.9.8.837
CVE-2019-12190
5.4
5%
May 21
XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter
Affected: through 0.9.8.747
CVE-2019-13599
5.3
4%
Aug 21
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times
Affected: 0.9.8.848
CVE-2019-13383
5.3
14%
Jul 16
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response
Affected: 0.9.8.836
CVE-2019-11429
4.8
6%
May 13
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on…
Affected: 0.9.8.753; 0.9.8.793; 0.9.8.807
CVE-2019-7646
4.8
7%
Mar 26
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via the add_package module parameter
Affected: through 0.9.8.763
CVE-2019-16295
4.6
0%
Oct 31
Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter
Affected: 0.9.8.855
CVE-2019-14725
4.3
1%
Sep 11
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker…
Affected: 0.9.8.851
CVE-2019-14730
4.3
2%
Sep 10
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a victim's account via an attacker account
Affected: 0.9.8.851
CVE-2019-14729
4.3
2%
Sep 10
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a victim's account via an attacker account
Affected: 0.9.8.851
CVE-2019-14728
4.3
2%
Sep 10
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding destination to a victim's account via an…
Affected: 0.9.8.851
CVE-2019-14727
4.3
2%
Sep 10
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password of a victim account via an attacker…
Affected: 0.9.8.851
CVE-2019-14723
4.3
2%
Sep 10
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacker account
Affected: 0.9.8.851
CVE-2019-14722
4.3
2%
Sep 10
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding destination from a victim's account via…
Affected: 0.9.8.851
CVE-2019-13385
4.3
2%
Jul 26
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users…
Affected: 0.9.8.840
Showing 25