Advisories · Technology
panel.
Every CVE that names panel among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.1 High
CtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass
- panel
- Broken access control
- CVSS 4.8 Medium
CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output
- panel
- Cross-site scripting (XSS)
- CWE-116
- CVSS 8.7 High
CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking
- panel
- Cross-site scripting (XSS)
- CVSS 10.0 CriticalCritical · CVSS 9+
CtrlPanel: Unauthenticated RCE using installer script
- panel
- Command injection
- Broken access control
- CVSS 6.5 Medium
CtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints
- panel
- Broken access control
- CVSS 6.6 Medium
CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php
- panel
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users
- panel
- Authentication bypass
- Weak cryptography or TLS
- CVSS 10.0 CriticalCritical · CVSS 9+
Convey Panel Directory Traversal in LocaleController leading to Remote Code Execution
- panel
- Path traversal
- File inclusion
- CVSS 8.1 High
Ctrlpanel has stored XSS vulnerability in TicketsController priority field
- panel
- Cross-site scripting (XSS)