Vulnerabilidades de VestaCP
CVEs publicadas que afetam produtos de VestaCP: 2 registro(s), com severidade, exploração e correções.
CVE-2020-36948
Crítica · 9.8
CWE-863 27/01/2026
VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation
VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions.
CVE-2021-47873
Alta · 7.2
CWE-79 21/01/2026
VestaCP < 0.9.8-25 - Stored Cross-Site Scripting
VestaCP versions prior to 0.9.8-25 contain a cross-site scripting vulnerability in the IP interface configuration that allows attackers to inject malicious scripts. Attackers can exploit the 'v_interface' parameter by sending a crafted POST request to the add/ip/ endpoint with a stored XSS payload.