CY
Product
CyberPanel
On CISA KEVExploited in the wildRansomware-linked
13
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 4Medium 5Low 0
Watch
Add CyberPanel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-51378 RansomwareIn wildKEV | 9.8 | Oct 29 | CyberPanel Incorrect Default Permissions Vulnerability Affected: before 2.3.8 |
| CVE-2024-51567 RansomwareIn wildKEV | 9.8 | Oct 29 | CyberPanel Incorrect Default Permissions Vulnerability Affected: before 2.3.8 |
| CVE-2024-51568 | 9.8 | Oct 29 | CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink Affected: before 2.3.5 |
| CVE-2026-41473 | 9.1 | Apr 24 | CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints Affected: before 2.4.4 |
| CVE-2021-47949 | 8.8 | May 10 | CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack Affected: <= 2.1 |
| CVE-2024-53376 | 8.8 | Dec 16 | CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation… Affected: before 2.3.8 |
| CVE-2019-13056 | 8.8 | Jul 2 | An issue was discovered in CyberPanel through 1.8.4 Affected: through 1.8.4 |
| CVE-2026-29811 | 7.7 | Sep 13 | CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query… Affected: before 2.4.4 |
| CVE-2024-54679 | 6.5 | Dec 5 | CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions Affected: through 2.3.7 |
| CVE-2026-41472 | 6.1 | Apr 24 | CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard Affected: before 2.4.4 |
| CVE-2024-56112 | 6.1 | Dec 16 | CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php Affected: before 2024-11-11 |
| CVE-2026-29810 | 4.3 | Sep 13 | CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic Affected: before 2.4.4 |
| CVE-2026-29812 | 4.3 | Sep 13 | CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list Affected: before 2.4.4 |
Showing 13