https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-15609.htmlhttps://patchthecve.com/cve/CVE-2020-15609.htmlWed, 17 Jun 2026 02:56:54 +0000CRITICAL 9.8: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_stop parameter, the processhttps://patchthecve.com/cve/CVE-2019-14246.htmlhttps://patchthecve.com/cve/CVE-2019-14246.htmlWed, 17 Jun 2026 02:18:02 +0000MEDIUM 6.5: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin passwords (of any user in /etc/passwd) via an attacker account.https://patchthecve.com/cve/CVE-2019-14245.htmlhttps://patchthecve.com/cve/CVE-2019-14245.htmlWed, 17 Jun 2026 02:18:01 +0000MEDIUM 6.5: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account.https://patchthecve.com/cve/CVE-2019-13386.htmlhttps://patchthecve.com/cve/CVE-2019-13386.htmlWed, 17 Jun 2026 02:16:40 +0000HIGH 8.8: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege.https://patchthecve.com/cve/CVE-2019-10893.htmlhttps://patchthecve.com/cve/CVE-2019-10893.htmlWed, 17 Jun 2026 02:11:50 +0000MEDIUM 4.8: CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Paylohttps://patchthecve.com/cve/CVE-2019-10261.htmlhttps://patchthecve.com/cve/CVE-2019-10261.htmlWed, 17 Jun 2026 02:10:35 +0000MEDIUM 4.8: CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action.