Black Friday60% off BLACKFRIDAY2026
Platform
PlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Exposed Panels·Updated Sep 2, 2025

CyberPanel - Command Injection

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
40
Times Used
continuous scan runs
10
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
10.0
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
n/aby n/a
n/a
cyber_panelby cyber_panel
AFFECTED< 2.3.5→SAFE ✓≥ 2.3.5
Updated Nov 10, 2026View on NVD →

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

Browse All Tools