Nov 4, 2025

Started

• Closed✓Patched

  CWP Control Web Panel: Control Web Panel OS Command Injection Vulnerability

  CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known. Added to CISA KEV on 2025-11-04.

  CWP Control Web Panel·Closed Nov 4, 2025·updated Nov 4, 2025

• Closed✓Patched

  Gladinet CentreStack and Triofox: CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

  Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files. Added to CISA KEV on 2025-11-04.

  Gladinet CentreStack and Triofox·Closed Nov 4, 2025·updated Nov 4, 2025