CVE-2024-39911: 1Panel SQL injection
Vulnerability summary
CVE-2024-39911 is a critical (CVSS 10.0) vulnerability in 1panel-dev 1panel. EPSS estimates a 4.53% chance of exploitation in the next 30 days, higher than 91.5% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 18-07-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-lts. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
4.53%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.53% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 found1Panel
Maturity: poc
Exploit Reference (blog.mo60.cn)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
1panel-dev1 product
- 1panel< 1.10.12-lts
Fit2cloud1 product
- 1panel≥ 1.10.10-lts, < 1.10.12-lts
Github.com/1Panel-dev1 product
- 1Panel< 1.10.12-lts
3 vendors · 3 products
References
3 links- github.com/1Panel-dev/1Panel/security/advisories/GHSA-7m53-pwp6-v3f5X Refsource CONFIRMWEBExploitVendor Advisory
