{"id":"CVE-2019-10893","aliases":["EUVD-2019-2615","GHSA-w67j-wff9-42gj"],"status":"published","title":"CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753...","description":"CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the \"CWP Settings \u003e \"Edit Settings\" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute.","severity":{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02826,"percentile":0.8669,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2019-04-18T19:50:16Z","modified":"2026-06-17T02:11:50Z","exploits":[{"source":"exploitdb","id":"EDB-46669","title":"CentOS Web Panel 0.9.8.793 (Free) / 0.9.8.753 (Pro) - Cross-Site Scripting","type":"webapps","platform":"linux","date":"2019-04-08","url":"https://www.exploit-db.com/exploits/46669"}],"products":[{"vendor":"centos-webpanel","product":"centos_web_panel"}],"references":[{"url":"http://forum.centos-webpanel.com/informations/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46669/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/152437/CentOS-Web-Panel-0.9.8.793-Free-0.9.8.753-Pro-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://packetstormsecurity.com/files/152437/centoswp098email-xss.txt","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/108035","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46669","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10893"},{"url":"http://forum.centos-webpanel.com/informations"},{"url":"https://github.com/advisories/GHSA-w67j-wff9-42gj"}],"sources":{"cve":[{"id":"CVE-2019-10893","description":"CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the \"CWP Settings \u003e \"Edit Settings\" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute.","status":"published","published":"2019-04-18T19:50:16Z","modified":"2024-08-04T22:40:15.137Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2019-2615","description":"CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the \"CWP Settings \u003e \"Edit Settings\" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute.","status":"published","published":"2019-04-18T19:50:16Z","modified":"2024-08-04T22:40:15Z","updated_at":"2026-11-03T02:40:50.763878Z"}],"ghsa":[{"id":"GHSA-w67j-wff9-42gj","title":"CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753...","description":"CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the \"CWP Settings \u003e \"Edit Settings\" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute.","status":"published","published":"2022-05-24T16:43:55Z","modified":"2024-04-04T00:01:40Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:55:48.925076Z"}],"nvd":[{"id":"CVE-2019-10893","description":"CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the \"CWP Settings \u003e \"Edit Settings\" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute.","status":"published","published":"2019-04-18T20:29:00.517Z","modified":"2026-06-17T02:11:50.223Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:11.426883Z"}]}}