CyberSec.Space Logo
CVEブラウザに戻る

CVE-2025-48703

🔥 Known Exploited (CISA KEV)CRITICAL
9.0
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-09-19
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Affected Platforms (CPE)

📦
Control Webpanel

Webpanel

< 0.9.8.1205

References & Advisories

🔗 https://fenrisk.com/rce-centos-webpanel
🔗 https://control-webpanel.com/changelog
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703

関連する脆弱性情報

CVE-2026-660535.9

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache T...

CVE-2026-586628.7

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue af...

CVE-2026-583898.7

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thri...

CVE-2026-580236.9

Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are re...