CVE-2021-46850

myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.

• CWE-88
• CWE-88

• https://blog.talosintelligence.com/2021/06/necro-python-bot-adds-new-tricks.htmlExploit, Technical Description, Third Party Advisory
• https://github.com/myvesta/vesta/commit/7991753ab7c5c568768028fb77554db8ea149f17Patch, Third Party Advisory
• https://github.com/myvesta/vesta/releases/tag/0.9.8-26-43Third Party Advisory
• https://github.com/serghey-rodin/vesta/commit/a4e4542a6d1351c2857b169f8621dd9a13a2e896Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/49674Exploit, Third Party Advisory, VDB Entry
• https://blog.talosintelligence.com/2021/06/necro-python-bot-adds-new-tricks.htmlExploit, Technical Description, Third Party Advisory
• https://github.com/myvesta/vesta/commit/7991753ab7c5c568768028fb77554db8ea149f17Patch, Third Party Advisory
• https://github.com/myvesta/vesta/releases/tag/0.9.8-26-43Third Party Advisory
• https://github.com/serghey-rodin/vesta/commit/a4e4542a6d1351c2857b169f8621dd9a13a2e896Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/49674Exploit, Third Party Advisory, VDB Entry

Published

Oct 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-46839The HW_KEYMASTER module has a vulnerability of missing bound…9.1
• CVE-2021-46840The HW_KEYMASTER module has an out-of-bounds access vulnerab…9.1
• CVE-2021-46841This issue was addressed by using HTTPS when sending informa…5.9
• CVE-2021-46846Cross Site Scripting vulnerability in Hewlett Packard Enterp…6.1
• CVE-2021-46848GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array …9.1
• CVE-2021-46849Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-46851The DRM module has a vulnerability in verifying the secure m…9.8
• CVE-2021-46852The memory management module has the logic bypass vulnerabil…7.5
• CVE-2021-46853Alpine before 2.25 allows remote attackers to cause a denial…5.9
• CVE-2021-46854mod_radius in ProFTPD before 1.3.7c allows memory disclosure…7.5
• CVE-2021-46856The multi-screen collaboration module has a path traversal v…7.5
• CVE-2021-46867The HW_KEYMASTER module has a problem in releasing memory.Su…7.5