{"id":"CVE-2013-2097","aliases":["EUVD-2013-2070","GHSA-vpr3-x98v-2vh4"],"status":"published","title":"ZPanel through 10.1.0 has Remote Command Execution","description":"ZPanel through 10.1.0 has Remote Command Execution","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.26047,"percentile":0.97997,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2020-02-12T15:09:01Z","modified":"2026-06-16T23:52:44Z","exploits":[{"source":"exploitdb","id":"EDB-25519","title":"ZPanel - 'templateparser.class.php' Crafted Template Remote Command Execution","type":"webapps","platform":"php","date":"2013-04-16","url":"https://www.exploit-db.com/exploits/25519"},{"source":"exploitdb","id":"EDB-38505","title":"Zpanel - Remote Code Execution (Metasploit)","type":"remote","platform":"php","date":"2015-10-21","verified":true,"url":"https://www.exploit-db.com/exploits/38505"},{"source":"metasploit","id":"exploit/multi/http/zpanel_information_disclosure_rce","title":"Zpanel Remote Unauthenticated RCE","type":"exploit","platform":"Linux,PHP","date":"2014-01-30","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/zpanel_information_disclosure_rce"}],"products":[{"vendor":"zpanel","product":"zpanel"},{"vendor":"zpanel project","product":"zpanel"},{"vendor":"zpanel_project","product":"zpanel"}],"references":[{"url":"http://packetstormsecurity.com/files/134030/Zpanel-10.1.0-Remote-Unauthenticated-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.exploit-db.com/exploits/25519","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2013/05/16/12","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/05/16/16","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84364","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2097"},{"url":"https://github.com/advisories/GHSA-vpr3-x98v-2vh4"}],"sources":{"cve":[{"id":"CVE-2013-2097","description":"ZPanel through 10.1.0 has Remote Command Execution","status":"published","published":"2020-02-12T15:09:01Z","modified":"2024-08-06T15:27:40.653Z","updated_at":"2026-11-02T14:34:56.530545Z"}],"euvd":[{"id":"EUVD-2013-2070","description":"ZPanel through 10.1.0 has Remote Command Execution","status":"published","published":"2020-02-12T15:09:01Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-vpr3-x98v-2vh4","title":"ZPanel through 10.1.0 has Remote Command Execution","description":"ZPanel through 10.1.0 has Remote Command Execution","status":"published","published":"2022-05-05T00:29:36Z","modified":"2023-02-01T05:01:56Z","updated_at":"2026-11-02T14:49:48.641892Z"}],"nvd":[{"id":"CVE-2013-2097","description":"ZPanel through 10.1.0 has Remote Command Execution","status":"published","published":"2020-02-12T16:15:10.723Z","modified":"2026-06-16T23:52:44.593Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:52.934105Z"}]}}