CVE-2024-51568
97Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 10epss 45%
from disclosure to weapon308 days
Published on NVDOct 29
1st PoC+308d
metasploitOct 27
VulnCheckOct 29
exploitation probability
45%top 1% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
Affected products
n/a · n/apublic PoCs found — 2
githubgithub.com/jsnv-dev/CVE-2024-51568---CyberPanel-Command-Injection-Nuclei-Template★ 1vulncheckvulncheck.com/xdb/69bb825a6eddunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.