CVE-2021-34257
HIGH 8.8EPSS 1.8%
Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.
- CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 6.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P - EPSS
- 1.82% chance of exploitation in the next 30 days, 77th percentile
- Published
- 2022-03-31
- Updated
- 2024-08-04
Proof-of-concept exploits (2)
- Sentinal920/WPanel4-Authenticated-RCE
- https://latestpcsolution.wordpress.com/2021/06/05/wpanel4-cms-authenticated-rce/