Ispconfig vulnerabilities
We track 2 vulnerabilities in Ispconfig products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 19, 2026.
2vulnerabilities
0critical
2high
0exploited
8.0average CVSS score
Latest Ispconfig vulnerabilities
- 8.8 High severity
ispconfig3: Improper Neutralization of Special Elements used in an SQL Command
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The buil
- 7.2 High severity
Ispconfig: Improper Control of Generation of Code
An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.