Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| wpanel/wpanel4-cms(Packagist) | 0 | N/A | N/A |
CVSS Metrics
