https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-3967.htmlhttps://patchthecve.com/cve/CVE-2022-3967.htmlWed, 17 Jun 2026 05:00:40 +0000MEDIUM 5.3: A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is 39561c32c12cabe56https://patchthecve.com/cve/CVE-2021-46850.htmlhttps://patchthecve.com/cve/CVE-2021-46850.htmlWed, 17 Jun 2026 04:15:39 +0000HIGH 7.2: myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.https://patchthecve.com/cve/CVE-2022-36305.htmlhttps://patchthecve.com/cve/CVE-2022-36305.htmlWed, 17 Jun 2026 04:53:11 +0000MEDIUM 6.1: Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /web/api/v1/upload/UploadHandler.php.https://patchthecve.com/cve/CVE-2022-36304.htmlhttps://patchthecve.com/cve/CVE-2022-36304.htmlWed, 17 Jun 2026 04:53:11 +0000MEDIUM 6.1: Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response function at /web/api/v1/upload/UploadHandler.php.https://patchthecve.com/cve/CVE-2022-36303.htmlhttps://patchthecve.com/cve/CVE-2022-36303.htmlWed, 17 Jun 2026 04:53:11 +0000MEDIUM 6.1: Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload function at /web/api/v1/upload/UploadHandler.php.https://patchthecve.com/cve/CVE-2022-34025.htmlhttps://patchthecve.com/cve/CVE-2022-34025.htmlWed, 17 Jun 2026 04:49:40 +0000MEDIUM 6.1: Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v1/upload/UploadHandler.php.https://patchthecve.com/cve/CVE-2021-43693.htmlhttps://patchthecve.com/cve/CVE-2021-43693.htmlWed, 17 Jun 2026 04:11:17 +0000CRITICAL 9.8: vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.https://patchthecve.com/cve/CVE-2021-30463.htmlhttps://patchthecve.com/cve/CVE-2021-30463.htmlWed, 17 Jun 2026 03:50:17 +0000HIGH 7.8: VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a /reset/?action=confirm&user=admin&codhttps://patchthecve.com/cve/CVE-2021-30462.htmlhttps://patchthecve.com/cve/CVE-2021-30462.htmlWed, 17 Jun 2026 03:50:17 +0000HIGH 7.2: VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts.https://patchthecve.com/cve/CVE-2021-28379.htmlhttps://patchthecve.com/cve/CVE-2021-28379.htmlWed, 17 Jun 2026 03:46:18 +0000HIGH 8.8: web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.https://patchthecve.com/cve/CVE-2020-10787.htmlhttps://patchthecve.com/cve/CVE-2020-10787.htmlWed, 17 Jun 2026 02:48:26 +0000HIGH 8.8: An elevation of privilege in Vesta Control Panel through 0.9.8-26 allows an attacker to gain root system access from the admin account via v-change-user-password (aka the user password change script).https://patchthecve.com/cve/CVE-2020-10786.htmlhttps://patchthecve.com/cve/CVE-2020-10786.htmlWed, 17 Jun 2026 02:48:26 +0000HIGH 8.8: A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs.https://patchthecve.com/cve/CVE-2020-10966.htmlhttps://patchthecve.com/cve/CVE-2020-10966.htmlWed, 17 Jun 2026 02:48:45 +0000MEDIUM 6.5: In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.https://patchthecve.com/cve/CVE-2020-10808.htmlhttps://patchthecve.com/cve/CVE-2020-10808.htmlWed, 17 Jun 2026 02:48:28 +0000HIGH 8.8: Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell mehttps://patchthecve.com/cve/CVE-2019-9859.htmlhttps://patchthecve.com/cve/CVE-2019-9859.htmlWed, 17 Jun 2026 02:44:44 +0000HIGH 8.8: Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. The platform works with PHP as the frontend language and uses shell scripts to execute system actions. PHP executes shell script through the d