References https://avd.aliyun.com/detail?id=AVD-2025-67888 https://www.ctfiot.com/95194.html https://cve.imfht.com/detail/CVE-2025-48703 https://www.h3c.com/cn/d_202302/1782196_30003_0.htm https://cve.imfht.com/detail/CVE-2022-44877 https://www.tenablecloud.cn/plugins/was/113546 https://www.sentinelone.com/vulnerability-database/cve-2022-44877/ https://fenrisk.com/rce-centos-webpanel https://nvd.nist.gov/vuln/detail/CVE-2022-44877 https://nvd.nist.gov/vuln/detail/CVE-2025-48703 https://www.secpod.com/blog/control-web-panel-breached-critical-rce-exploited-in-the-wild/ https://control-webpanel.com/changelog https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-centos-web-panel-bug-exploited-in-attacks/
Related VulnerabilitiesPoCCVE-2026-34234: CtrlPanel <= 1.1.1 - Remote Code ExecutionPoCCVE-2026-86206: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header SpoofingPoCCVE-2026-87820: CyberPanel 2.4.3-2.4.5 - AI Scanner Debug DisclosurePoCjohnson-controls-default-login: Johnson Controls Frick Quantum HD Compressors - Default Login畅捷通T+系统 AccountExtendRuleController接口处存在反序列化漏洞PoCccm-detect: Clear-Com Core Configuration Manager Panel - Detect金和OA /c6/JHSoft.Web.CostControl/Decompose/AjaxForCenterBudgetDecompose.ashx SQL 注入漏洞金和OA /c6/JHSoft.Web.CostControl/BudgetExecution/VouchUpdate.aspx SQL 注入漏洞PoCprodigy-panel: Prodigy Annotation Tool - Unauthenticated Exposure天问物业ERP系统 /HM/M_Main/HC/DataGetControl.aspx SQL 注入漏洞技嘉科技|Gigabyte Control Center - Improper Access ControlPoCctrlpanel-installer: CtrlPanel Installer ExposurePoCmybb-installer: MyBB Installation Panel - Detect