HIGH🇵🇱 Wersja polska

CVE-2025-66507

CVSS 7.5v3.1pub. 2025-12-09upd. 2025-12-10

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections can be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). This issue is fixed in version 2.0.14.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Fit2cloud 1panel

    APP
    Fit2Cloud
    < 2.0.14
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2024-39907CRITICAL9.8PL ✓ten sam produkt

SQL Injection w Fit2Cloud 1Panel umożliwiający RCE poprzez zapis plików

CVE-2024-39911CRITICAL10.0PL ✓ten sam produkt

SQL Injection przez nagłówek User-Agent w Fit2Cloud 1Panel

CVE-2025-34429HIGH7.0ten sam produkt

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port con...

CVE-2025-34410HIGH7.0ten sam produkt

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Usern...

CVE-2025-56413HIGH8.8ten sam produkt

OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitr...