myvesta/vesta

myvesta/vesta

GitHubGitHub
GitHubgithub.com
www.myvestacp.comwww.myvestacp.com
Releases45
Frequency3 months 4 days
Last Release
Stars308
myVESTA Control Panel
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2021-46850↗
7.2 HIGH—

myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.

CVE-2021-28379↗
8.8 HIGH6.8 MEDIUM

web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.