Vulnerabilidades em 1Panel-dev

79 resultados
Análise Vexday

Com 53 CVEs catalogadas e nenhuma registrada no catálogo KEV da CISA, o 1Panel-dev apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere pressão ofensiva ainda limitada — embora 6 vulnerabilidades já contem com PoC pública, elevando o risco de aproveitamento oportunista. O volume de 23 falhas surgidas nos últimos 90 dias indica ritmo acelerado de descoberta recente, exigindo atenção contínua ao ciclo de patching. O tipo de falha predominante é CWE-79 (Cross-Site Scripting), padrão que frequentemente viabiliza ataques de injeção de conteúdo e sequestro de sessão em interfaces web. A CVE mais crítica no momento é CVE-2024-39907, com escore EPSS de 0,294, valor que a posiciona entre as de maior probabilidade de exploração no portfólio e que deve ser priorizada em qualquer ciclo de remediação.

CVE-2025-66507HIGH1Panel – CAPTCHA Bypass via Client-Controlled FlagEPSS 0.5%CVE-2025-48950MEDIUMMaxKB Python Sandbox Bypass in Function LibraryEPSS 0.4%CVE-2023-39965MEDIUM1Panel Unauthorized access in BackendEPSS 0.4%CVE-2025-53928MEDIUMMaxKB has RCE in MCP callEPSS 0.4%CVE-2026-76900MEDIUMCordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at RuntimeEPSS 0.4%CVE-2024-30257LOW1Panel's password verification is suspected to have a timing attack vulnerabilityEPSS 0.4%CVE-2026-16222MEDIUM1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgeryEPSS 0.4%CVE-2026-16223MEDIUM1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgeryEPSS 0.4%CVE-2026-39424MEDIUMMaxKB has CSV Injection in its Application Chat Export FunctionalityEPSS 0.4%CVE-2026-23525MEDIUM1panel App Store vulnerable to Cross-site ScriptingEPSS 0.4%CVE-2026-65956CRITICALKubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRFEPSS 0.4%CVE-2025-66446HIGHMaxKB has a Python sandbox LD_PRELOAD bypassEPSS 0.3%CVE-2026-76901MEDIUMCordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accountsEPSS 0.3%CVE-2025-10433MEDIUM1Panel-dev MaxKB debug deserializationEPSS 0.3%CVE-2025-66419HIGHMaxKB vulnerable to privilege escalation through sandbox bypassEPSS 0.3%CVE-2024-24768MEDIUM1Panel set-cookie is missing the Secure keywordEPSS 0.3%CVE-2026-76899MEDIUMCordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`EPSS 0.3%CVE-2026-56779MEDIUMMaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url ParametersEPSS 0.3%CVE-2026-52745MEDIUMCordysCRM: Customer Public Pool Sorting Field SQL InjectionEPSS 0.3%CVE-2025-32383MEDIUMMaxKB has a reverse shell vulnerability in function libraryEPSS 0.3%