Filtered by vendor Vestacp Subscriptions
Total 24 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-25117 2 Linux, Vestacp 2 Linux, Control Panel 2025-10-21 N/A
VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS bot that uses Lua for second- and third-stage components. The compromise leaked administrative credentials (base64-encoded admin password and server domain) to an external URL during installation and/or resulted in the installer dropping and executing a DDoS malware payload under local system privileges. Compromised servers were subsequently observed participating in large-scale DDoS activity. Vesta acknowledged exploitation in the wild in October 2018.
CVE-2021-46850 1 Vestacp 2 Control Panel, Vesta Control Panel 2025-05-07 7.2 High
myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.
CVE-2022-3967 1 Vestacp 1 Control Panel 2025-04-15 5.3 Medium
A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is 39561c32c12cabe563de48cc96eccb9e2c655e25. It is recommended to apply a patch to fix this issue. VDB-213546 is the identifier assigned to this vulnerability.
CVE-2015-2861 1 Vestacp 1 Vesta Control Panel 2025-04-12 N/A
Cross-site request forgery (CSRF) vulnerability in Vesta Control Panel before 0.9.8-14 allows remote attackers to hijack the authentication of arbitrary users.
CVE-2022-36305 1 Vestacp 1 Vesta Control Panel 2024-11-21 6.1 Medium
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /web/api/v1/upload/UploadHandler.php.
CVE-2022-36304 1 Vestacp 1 Vesta Control Panel 2024-11-21 6.1 Medium
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response function at /web/api/v1/upload/UploadHandler.php.
CVE-2022-36303 1 Vestacp 1 Vesta Control Panel 2024-11-21 6.1 Medium
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload function at /web/api/v1/upload/UploadHandler.php.
CVE-2022-34025 1 Vestacp 1 Vesta Control Panel 2024-11-21 6.1 Medium
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v1/upload/UploadHandler.php.
CVE-2021-43693 1 Vestacp 1 Vesta Control Panel 2024-11-21 9.8 Critical
vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.
CVE-2021-30463 1 Vestacp 1 Control Panel 2024-11-21 7.8 High
VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a /reset/?action=confirm&user=admin&code= URI. This occurs because chmod is used unsafely.
CVE-2021-30462 1 Vestacp 1 Vesta Control Panel 2024-11-21 7.2 High
VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts.
CVE-2021-28379 2 Myvestacp, Vestacp 2 Myvesta, Vesta Control Panel 2024-11-21 8.8 High
web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.
CVE-2020-10966 2 Hestiacp, Vestacp 2 Control Panel, Control Panel 2024-11-21 6.5 Medium
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.
CVE-2020-10808 1 Vestacp 1 Vesta Control Panel 2024-11-21 8.8 High
Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters.
CVE-2020-10787 1 Vestacp 1 Vesta Control Panel 2024-11-21 8.8 High
An elevation of privilege in Vesta Control Panel through 0.9.8-26 allows an attacker to gain root system access from the admin account via v-change-user-password (aka the user password change script).
CVE-2020-10786 1 Vestacp 1 Vesta Control Panel 2024-11-21 8.8 High
A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs.
CVE-2019-9859 1 Vestacp 1 Vesta Control Panel 2024-11-21 8.8 High
Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. The platform works with PHP as the frontend language and uses shell scripts to execute system actions. PHP executes shell script through the dangerous command exec. This function can be dangerous if arguments passed to it are not filtered. Every user input in VestaCP that is used as an argument is filtered with the escapeshellarg function. This function comes from the PHP library directly and its description is as follows: "escapeshellarg() adds single quotes around a string and quotes/escapes any existing single quotes allowing you to pass a string directly to a shell function and having it be treated as a single safe argument." It means that if you give Username, it will have 'Username' as a replacement. This works well and protects users from exploiting this potentially dangerous exec function. Unfortunately, VestaCP uses this escapeshellarg function incorrectly in several places.
CVE-2019-9841 1 Vestacp 1 Control Panel 2024-11-21 N/A
Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.
CVE-2019-12792 1 Vestacp 1 Control Panel 2024-11-21 N/A
A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root.
CVE-2019-12791 1 Vestacp 1 Control Panel 2024-11-21 N/A
A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root via the password reset form.