Ispconfig vulnerabilities

Products

• Ispconfig 12

Newest

• ispconfig ispconfig3 ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter CVE-2026-61518 8.7 HighAugust 19, 2026
• ispconfig ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage. CVE-2025-52206 4.7 MediumMay 5, 2026
• ispconfig An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the... CVE-2023-46818 Public exploit EPSS 19.2% 7.2 HighOctober 27, 2023
• ispconfig ISPConfig before 3.2.2 allows SQL injection. CVE-2021-3021 9.8 CriticalJanuary 5, 2021
• ispconfig ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is... CVE-2020-9398 9.8 CriticalFebruary 25, 2020
• ispconfig ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution CVE-2013-3629 Public exploit EPSS 43.1% 8.8 HighFebruary 7, 2020
• ispconfig ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client... CVE-2012-2087 9.8 CriticalJanuary 23, 2020
• ispconfig An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to... CVE-2018-17984 7.8 HighOctober 4, 2018
• ispconfig ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a... CVE-2017-17384 8.8 HighDecember 7, 2017
• ispconfig Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow... CVE-2015-4119 Public exploit 6.8 MediumJune 15, 2015
• ispconfig SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows... CVE-2015-4118 Public exploit 6.5 MediumJune 15, 2015
• ispconfig ** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in ISPConfig 2.2.3 allow... CVE-2006-3042 Public exploitDisputed 7.5 HighJune 15, 2006
• ispconfig ** DISPUTED ** PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and... CVE-2006-2315 Public exploitDisputed 7.5 HighMay 12, 2006