CyberPower PowerPanel Enterprise

• CVE-2023-3267 Critical 9.1 When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority Syst 1.8%
• CVE-2023-3266 Critical 9.8 A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated atta 0.9%
• CVE-2023-3265 Critical 9.8 An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user " 1.6%