Virtualizor
Monthly
Unauthenticated attackers can rewrite any tenant's account balance in Softaculous Virtualizor before 3.2.9 (Patch 9) and in 3.0.0 by POSTing crafted 'act' and 'from_billing_module' parameters together with a 'billing_data' body containing arbitrary uid and balance values to the admin panel dispatcher, which executes a parameterized UPDATE against the users table without performing any authorization check. Publicly available exploit code exists, and vendor patches are available (3.2.9 Patch 9 and 3.3.0). Because no credentials, privileges, or user interaction are required (CVSS:3.1 PR:N/UI:N), any internet-reachable Virtualizor admin panel is directly exposed; the assessed impact is integrity-only - account balance manipulation that can drive automated service suspension for targeted accounts - not code execution or data disclosure.
Remote code execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 line) allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting a PHP object injection flaw in the billing module handler, where untrusted serialized data in the billing_data POST field is passed to unserialize() without allowed_classes restrictions. Publicly available exploit code exists. Our assessment rates this 9.8 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N), while the vendor's CVSS 4.0 score is 9.2 (AC:H), reflecting the dependency on a reachable POP chain; no authentication or user interaction is required.
Unauthenticated remote command execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 branch) lets attackers take root on the host and all managed VPS instances by exploiting the billing module handler. Publicly available exploit code exists, and exploitation requires only network reachability to the billing/panel interface-no authentication or user interaction. Vendor patches are available in 3.2.9 Patch 9 and 3.3.0, making immediate upgrade the top priority.
Unauthenticated attackers can rewrite any tenant's account balance in Softaculous Virtualizor before 3.2.9 (Patch 9) and in 3.0.0 by POSTing crafted 'act' and 'from_billing_module' parameters together with a 'billing_data' body containing arbitrary uid and balance values to the admin panel dispatcher, which executes a parameterized UPDATE against the users table without performing any authorization check. Publicly available exploit code exists, and vendor patches are available (3.2.9 Patch 9 and 3.3.0). Because no credentials, privileges, or user interaction are required (CVSS:3.1 PR:N/UI:N), any internet-reachable Virtualizor admin panel is directly exposed; the assessed impact is integrity-only - account balance manipulation that can drive automated service suspension for targeted accounts - not code execution or data disclosure.
Remote code execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 line) allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting a PHP object injection flaw in the billing module handler, where untrusted serialized data in the billing_data POST field is passed to unserialize() without allowed_classes restrictions. Publicly available exploit code exists. Our assessment rates this 9.8 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N), while the vendor's CVSS 4.0 score is 9.2 (AC:H), reflecting the dependency on a reachable POP chain; no authentication or user interaction is required.
Unauthenticated remote command execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 branch) lets attackers take root on the host and all managed VPS instances by exploiting the billing module handler. Publicly available exploit code exists, and exploitation requires only network reachability to the billing/panel interface-no authentication or user interaction. Vendor patches are available in 3.2.9 Patch 9 and 3.3.0, making immediate upgrade the top priority.