Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Dec 30, 2025A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1.CVE-2025-15241 · Other software · CloudPanel · reported by VulDBLow 2
A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1. The affected element is an unknown function of the file /admin/users of the component HTTP Header Handler. Such manipulation of the argument Referer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.5.2 is sufficient to fix this issue. Upgrading the affected component is recommended.
- Product
- Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass CVE-2024-44765 · Other software · mgt-commerce · reported by MITREMedium 6.5
An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.
- Product
- cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information and execute arbitraryCVE-2024-24320 · Other software · mgt-commerce · reported by MITREHigh 8.8
Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information and execute arbitrary code via the service parameter of the load-logfiles function.
- Product
- cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and changing fileCVE-2023-46157 · Other software · Mgt-commerce · reported by MITREHigh 8.8
File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownership and changing file permissions to 4755.
- Product
- Cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudpanel.iomgt-commerce.com
Jun 25, 2023In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.CVE-2023-36630 · Other software · Mgt-commerce · reported by MITREHigh 8.8
In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.
- Product
- Cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcloudpanel.io
Jun 20, 2023CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.CVE-2023-35885 · Other software · Mgt-commerce · reported by MITRECritical 9.8
CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
- Product
- Cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcloudpanel.io
Jun 6, 2023CloudPanel v2.2.2 allows attackers to execute a path traversal.CVE-2023-33747 · Other software · Mgt-commerce · reported by MITREHigh 7.8
CloudPanel v2.2.2 allows attackers to execute a path traversal.
- Product
- Cloudpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcwe.mitre.org
Mar 21, 2023MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudCVE-2023-0391 · Other software · MGT-COMMERCE · reported by cve@rapid7.comHigh 8.1
MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudPanel. This behavior was observed in version 2.2.0. There has been no indication from the vendor this has been addressed in version 2.2.1.
- Product
- CloudPanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbleepingcomputer.comrapid7.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.