Solusvm 2
Monthly
Server-side template injection in SolusVM 2 up to and including build 2.0.0-44576 lets a remote authenticated user run arbitrary code as root on the management node, so a single low-privileged panel account - a client, reseller, or sub-account on the hosting provider's instance - is enough to potentially take over the underlying virtualization infrastructure. Exploitation requires valid credentials (CVSS PR:L) and no user interaction (UI:N), which is the primary limiting factor and excludes fully anonymous attackers, but because the injected template reaches a code-execution sink running with root privileges the confidentiality, integrity, and availability impact is high across both the vulnerable component and dependent systems (CVSS 9.4). No public exploit identified at time of analysis and the flaw is not reported as confirmed actively exploited.
Server-side template injection in SolusVM 2 up to and including build 2.0.0-44576 lets a remote authenticated user run arbitrary code as root on the management node, so a single low-privileged panel account - a client, reseller, or sub-account on the hosting provider's instance - is enough to potentially take over the underlying virtualization infrastructure. Exploitation requires valid credentials (CVSS PR:L) and no user interaction (UI:N), which is the primary limiting factor and excludes fully anonymous attackers, but because the injected template reaches a code-execution sink running with root privileges the confidentiality, integrity, and availability impact is high across both the vulnerable component and dependent systems (CVSS 9.4). No public exploit identified at time of analysis and the flaw is not reported as confirmed actively exploited.