Skip to content
OpenAdvisories

Vendor

usmannasir

11 known vulnerabilities.

Products

cyberpanel 11
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.2
    CVE-2026-88895

    CyberPanel before 3.0.5 Authentication Bypass via API

    CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrativ…

    usmannasir cyberpanel
  • High 8.8
    CVE-2026-71966

    CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer

    CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Atta…

    usmannasir cyberpanel
  • High 8.8
    CVE-2026-71965

    CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature

    CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers c…

    usmannasir cyberpanel
  • High 8.8
    CVE-2026-65917

    CyberPanel IncBackups IDOR via Sequential Backup ID

    CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated pan…

    usmannasir cyberpanel
  • High 8.1
    CVE-2026-65916

    CyberPanel Missing Authorization in cancelBackupCreation Handler

    CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests…

    usmannasir cyberpanel
  • High 8.8
    CVE-2026-41473 Public exploit

    CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints

    CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-web…

    usmannasir cyberpanel