Skip to content
OpenAdvisories

Vendor

Ajenti Project

6 known vulnerabilities.

Products

ajenti 6
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-79920

    Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

    Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. …

    Ajenti Project ajenti
  • Critical 9.3
    CVE-2026-40177

    Password bypass when 2FA is activated

    ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.

    Ajenti Project ajenti ajenti-plugin-core PyPI
  • Critical 9.8
    CVE-2020-37002

    Ajenti 2.1.36 Authenticated Remote Code Execution

    Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/terminal/create endpoint to send a netcat reverse shell paylo…

    Ajenti Project ajenti