UpHeron
All vulnerabilities

Servers and applications

CVE-2019-15235

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to gain access to the victim's password (for the OS and phpMyAdmin) via an attacker account. This is different from CVE-2019-14782.

Severity
Medium 6.5
Published
17 Dec 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
1.4% in the next 30 daysHigher than 72% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Control Web PanelServers and applications · cpe:a:control-webpanel:webpanel
  • From 0.9.8.856 up to 0.9.8.864

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-15235
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-15235