CVE-2024-27288

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
1Panel-dev1Panel< 1.10.1-lts
fit2cloud1panel< 1.10.1-lts

References

Timeline

Published
Mar 6, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-272898.1pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are metCVE-2024-27296.1The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the finalCVE-2024-272906.1Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, includingCVE-2024-272916.1Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, it is possible to create a URL that acts as anCVE-2024-272927.5Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access CVE-2024-272947.8dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with theCVE-2024-272958.2Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allowsCVE-2024-272965.3Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number CVE-2024-272975.9Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the NixCVE-2024-2729810.0parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PosCVE-2024-272998.8phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has beeCVE-2024-27305.3Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public prev