Ispconfig
Products
2- 7 CVEs
- 1 CVE
Recent CVEs
8| CVE | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2017-17384 | Hig | 0.57 | 8.8 | 0.00 | Dec 7, 2017 | ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job. | |
| CVE-2025-52206 | Med | 0.31 | 4.7 | 0.00 | May 5, 2026 | ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage. | |
| CVE-2013-3629 | 0.09 | — | 0.76 | Feb 7, 2020 | ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution | ||
| CVE-2006-3042 | 0.04 | — | 0.07 | Jun 15, 2006 | Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) go_info[isp][classes_root] parameter in (a) server.inc.php, and the (2) go_info[server][classes_root] parameter in (b) app.inc.php, (c) login.php, and (d) trylogin.php. NOTE: this issue has been disputed by the vendor, who states that the original researcher "reviewed the installation tarball that is not identical with the resulting system after installtion. The file, where the $go_info array is declared ... is created by the installer. | ||
| CVE-2006-2315 | 0.04 | — | 0.13 | May 12, 2006 | PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the go_info[server][classes_root] parameter. NOTE: the vendor has disputed this vulnerability, saying that session.inc.php is not under the web root in version 2.2, and register_globals is not enabled | ||
| CVE-2015-4119 | 0.03 | — | 0.05 | Jun 15, 2015 | Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a request to admin/users_edit.php or (2) arbitrary users for requests that conduct SQL injection attacks via the server parameter to monitor/show_sys_state.php. | ||
| CVE-2015-4118 | 0.03 | — | 0.02 | Jun 15, 2015 | SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter. NOTE: this can be leveraged by remote attackers using CVE-2015-4119.2. | ||
| CVE-2012-2087 | 0.00 | — | 0.03 | Jan 23, 2020 | ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface. |
- risk 0.57cvss 8.8epss 0.00
ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
- risk 0.31cvss 4.7epss 0.00
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.
- CVE-2013-3629Feb 7, 2020risk 0.09cvss —epss 0.76
ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution
- CVE-2006-3042Jun 15, 2006risk 0.04cvss —epss 0.07
Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) go_info[isp][classes_root] parameter in (a) server.inc.php, and the (2) go_info[server][classes_root] parameter in (b) app.inc.php, (c) login.php, and (d) trylogin.php. NOTE: this issue has been disputed by the vendor, who states that the original researcher "reviewed the installation tarball that is not identical with the resulting system after installtion. The file, where the $go_info array is declared ... is created by the installer.
- CVE-2006-2315May 12, 2006risk 0.04cvss —epss 0.13
PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the go_info[server][classes_root] parameter. NOTE: the vendor has disputed this vulnerability, saying that session.inc.php is not under the web root in version 2.2, and register_globals is not enabled
- CVE-2015-4119Jun 15, 2015risk 0.03cvss —epss 0.05
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of (1) administrators for requests that create an administrator account via a request to admin/users_edit.php or (2) arbitrary users for requests that conduct SQL injection attacks via the server parameter to monitor/show_sys_state.php.
- CVE-2015-4118Jun 15, 2015risk 0.03cvss —epss 0.02
SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter. NOTE: this can be leveraged by remote attackers using CVE-2015-4119.2.
- CVE-2012-2087Jan 23, 2020risk 0.00cvss —epss 0.03
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.