Ajenti vulnerabilities
3 known CVE vulnerabilities in Ajenti, translated and rated.
- CVE-2020-37002Critical
Ajenti version 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/terminal/create endpoint to send a netcat reverse shell payload targeting a specified IP and port.
- CVE-2026-38979Medium
Ajenti up to version 2.2.13 has a clickjacking vulnerability in the login and administrative UI. Missing X-Frame-Options and Content-Security-Policy frame-ancestors headers in HTTP responses allow the page to be embedded in an iframe.
- CVE-2026-35175Medium
Ajenti before version 2.2.15 allows an authenticated user (using the auth_users plugin) to install a custom package even if not a superuser. This vulnerability is fixed in version 2.2.15.