Skip to content
OpenAdvisories

Vendor

usmannasir

11 known vulnerabilities.

usmannasir at a glance

Last 12 months
11
Critical · all time
1
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 2 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 2 vulnerabilities August 2026: 5 vulnerabilities, 1 critical September 2026: 2 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202620
Aug 202651
Jul 202620
Jun 202600
May 202600
Apr 202620
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

cyberpanel 11
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • High 7.2
    CVE-2026-88895

    CyberPanel before 3.0.5 Authentication Bypass via API

    CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrativ…

    usmannasir cyberpanel
  • Medium 5.3
    CVE-2026-87820

    CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner

    CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel admini…

    usmannasir cyberpanel
  • Medium 4.9
    CVE-2026-67613

    CyberPanel < 3.0.0 Path Traversal File Read via cloudAPI ReadReport

    CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the r…

    usmannasir cyberpanel
  • Critical 9.8
    CVE-2026-67614

    CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal

    CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. At…

    usmannasir cyberpanel
  • High 8.8
    CVE-2026-71966

    CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer

    CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Atta…

    usmannasir cyberpanel
  • High 8.8
    CVE-2026-71965

    CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature

    CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers c…

    usmannasir cyberpanel
  • Medium 6.5
    CVE-2026-71964

    CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload

    CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers c…

    usmannasir cyberpanel
  • High 8.8
    CVE-2026-65917

    CyberPanel IncBackups IDOR via Sequential Backup ID

    CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated pan…

    usmannasir cyberpanel
  • High 8.1
    CVE-2026-65916

    CyberPanel Missing Authorization in cancelBackupCreation Handler

    CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests…

    usmannasir cyberpanel
  • High 8.8
    CVE-2026-41473 Public exploit

    CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints

    CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-web…

    usmannasir cyberpanel
  • Medium 5.3
    CVE-2026-41472 Public exploit

    CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard

    CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by ove…

    usmannasir cyberpanel