Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Aug 19, 2026ISPConfig contains an authenticated SQL injection vulnerability in the Remote API.CVE-2026-61518 · Other software · ispconfig · reported by VulnCheckHigh 8.7
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not block quote-free boolean payloads and does not reject requests in its default configuration. A remote API user holding any single low-privilege function permission can inject arbitrary SQL to delete or modify records across all tenants in the control panel database and extract arbitrary data via blind boolean inference, including password hashes and client records.
- Product
- ispconfig3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
May 5, 2026ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.CVE-2025-52206 · Other software · Ispconfig · reported by MITREMedium 4.7
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.
- Product
- Ispconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024WP-ISPConfig 3: Cross-Site Request Forgery (CSRF)CVE-2024-53720 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ole1986 WP-ISPConfig 3 wp-ispconfig3 allows Stored XSS.This issue affects WP-ISPConfig 3: from n/a through <= 1.5.6.
- Product
- WP-ISPConfig 3
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update WP-ISPConfig 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 27, 2023An issue was discovered in ISPConfig before 3.2.11p1.CVE-2023-46818 · Other software · Ispconfig · reported by MITREHigh 7.2
An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.
- Product
- Ispconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 5, 2021ISPConfig before 3.2.2 allows SQL injection.CVE-2021-3021 · Other software · Ispconfig · reported by MITRECritical 9.8
ISPConfig before 3.2.2 allows SQL injection.
- Product
- Ispconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwitter.comispconfig.org
Feb 25, 2020ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.CVE-2020-9398 · Other software · Ispconfig · reported by MITRECritical 9.8
ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
- Product
- Ispconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordispconfig.orgispconfig.org
Feb 7, 2020ISPConfig 3.0.5.2 has Arbitrary PHP Code ExecutionCVE-2013-3629 · Other software · ISPConfig · reported by cret@cert.orgHigh 8.8
ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution
- Product
- ISPConfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
Jan 23, 2020ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.CVE-2012-2087 · Other software · ISPConfig · reported by Red HatCritical 9.8
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
- Product
- ISPConfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Oct 4, 2018An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution.CVE-2018-17984 · Other software · Ispconfig · reported by MITREHigh 7.8
An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access.
- Product
- Ispconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0x09al.github.iogithub.com
Dec 7, 2017ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.CVE-2017-17384 · Other software · Ispconfig · reported by MITREHigh 8.8
ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
- Product
- Ispconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordispconfig.orgispconfig.org
Jun 15, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administratoCVE-2015-4119 · Other software · Ispconfig · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a request to admin/users_edit.php or (2) arbitrary users for requests that conduct SQL injection attacks via the server parameter to monitor/show_sys_state.php.
- Product
- Ispconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugtracker.ispconfig.orgpacketstormsecurity.com
Jun 15, 2015SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arCVE-2015-4118 · Other software · Ispconfig · reported by MITREMedium 6.5
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter. NOTE: this can be leveraged by remote attackers using CVE-2015-4119.2.
- Product
- Ispconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugtracker.ispconfig.orgpacketstormsecurity.com
Jun 15, 2006Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) go_info[isp][claCVE-2006-3042 · Other software · Ispconfig · reported by MITREHigh 7.5
Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) go_info[isp][classes_root] parameter in (a) server.inc.php, and the (2) go_info[server][classes_root] parameter in (b) app.inc.php, (c) login.php, and (d) trylogin.php. NOTE: this issue has been disputed by the vendor, who states that the original researcher "reviewed the installation tarball that is not identical with the resulting system after installtion. The file, where the $go_info array is declared ... is created by the installer.
- Product
- Ispconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comosvdb.org
May 11, 2006PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in theCVE-2006-2315 · Other software · Ispconfig · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the go_info[server][classes_root] parameter. NOTE: the vendor has disputed this vulnerability, saying that session.inc.php is not under the web root in version 2.2, and register_globals is not enabled
- Product
- Ispconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.uksecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.