Hotplugin0X01

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata endpoints, with small responses returned verbatim enabling credential theft and internal service enumeration.

**Name of the Vulnerable Software and Affected Versions** CyberPanel versions before 6778ad1 **Description** The issue concerns a lack of permission check for the `FilemanagerAdmin` capability when performing restart MySQL actions. This allows unauthorized access to restart MySQL without proper authorization. **Recommendations** For versions before 6778ad1, update to a version that includes the fix for this issue to ensure that the `FilemanagerAdmin` capability is properly checked for restart MySQL actions.