CVE-2019-10893

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute.

• CWE-79

• http://forum.centos-webpanel.com/informations/Vendor Advisory
• http://packetstormsecurity.com/files/152437/CentOS-Web-Panel-0.9.8.793-Free-0.9.8.753-Pro-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/108035Third Party Advisory, VDB Entry
• https://packetstormsecurity.com/files/152437/centoswp098email-xss.txtThird Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46669Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46669/Exploit, Third Party Advisory, VDB Entry
• http://forum.centos-webpanel.com/informations/Vendor Advisory
• http://packetstormsecurity.com/files/152437/CentOS-Web-Panel-0.9.8.793-Free-0.9.8.753-Pro-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/108035Third Party Advisory, VDB Entry
• https://packetstormsecurity.com/files/152437/centoswp098email-xss.txtThird Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46669Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46669/Exploit, Third Party Advisory, VDB Entry

Published

Apr 18, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10886An incorrect access control exists in the Sony Photo Sharing…
• CVE-2019-10887A reflected HTML injection vulnerability on Salicru SLC-20-c…6.1
• CVE-2019-10888A CSRF Issue that can add an admin user was discovered in UK…
• CVE-2019-1089An elevation of privilege vulnerability exists in rpcss.dll …
• CVE-2019-10891An issue was discovered in D-Link DIR-806 devices. There is …9.8
• CVE-2019-10892An issue was discovered in D-Link DIR-806 devices. There is …
• CVE-2019-10894In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the…7.5
• CVE-2019-10895In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the…7.5
• CVE-2019-10896In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the…7.5
• CVE-2019-10897In Wireshark 3.0.0, the IEEE 802.11 dissector could go into …
• CVE-2019-10898In Wireshark 3.0.0, the GSUP dissector could go into an infi…
• CVE-2019-10899In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the…7.5