Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2021-45467: CWP CentOS Web Panel - preauth RCE

pwn.ai | vulnerability | CVE-2021-45467 | #rce | #pre-auth-rce | #cwp | #cve-2021-45467 | #file-inclusion | #hosting-control-panel

Summary

Octagon Networks chains file inclusion (CVE-2021-45467) and file write (CVE-2021-45466) to achieve pre-auth root command execution on CWP CentOS Web Panel, used by 200,000+ servers.
CVE
CVE-2021-45467
Published
Collected

original ↗

Related coverage

Critical · vulnerability · pwn.ai
CVE-2025-54322 (ZERODAY) - Unauthenticated Root RCE affecting ~70,000+ Hosts
pwn.ai's agent-found zero-day: CVE-2025-54322 yields unauthenticated root RCE on Xspeeder SXZOS edge devices, tens of thousands exposed, disclosed after seven months of vendor silence.
vulnerability · pwn.ai
CVE-2022-24990: TerraMaster TOS unauthenticated remote command execution via PHP Object Instantiation
Octagon Networks' chain on TerraMaster TOS 4.2.29: a PHP object instantiation bug plus a signing-check bypass yields unauthenticated remote root command execution on NAS devices.
vulnerability · portswigger.net
Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)
A pre-auth RCE in ForgeRock OpenAM via unsafe deserialization in its Jato framework: the jato.pageSession parameter accepted Java objects exploitable with a custom ysoserial chain (CVE-2021-35464).
vulnerability · bishopfox.com
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.
High · vulnerability · github.com
WordPress Core Unauthenticated Path Traversal to LFI & RCE PoC (CVE-2026-87902)
While remote code execution depends on runtime prerequisites like PEAR, the unauthenticated LFI primitive resides directly in WordPress Core and affects all major branches from 4.7.0 through 7.1.1.
vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
back