{"id":"CVE-2023-29489","aliases":["EUVD-2023-33056","GHSA-84fm-c8wr-cf69"],"status":"published","title":"An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page...","description":"An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:L/A:L/C:L/I:L/PR:L/S:U/UI:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.65533,"percentile":0.99268,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2023-04-27T00:00:00Z","modified":"2026-06-17T05:50:12Z","exploits":[{"source":"nuclei","id":"CVE-2023-29489","title":"cPanel \u003c 11.109.9999.116 - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29489.yaml"},{"source":"pocgithub","id":"0-d3y/CVE-2023-29489","title":"0-d3y/CVE-2023-29489","date":"2023-05-17","url":"https://github.com/0-d3y/CVE-2023-29489"},{"source":"pocgithub","id":"Abdullah7-ma/CVE-2023-29489","title":"Abdullah7-ma/CVE-2023-29489","date":"2023-06-01","url":"https://github.com/Abdullah7-ma/CVE-2023-29489"},{"source":"pocgithub","id":"Cappricio-Securities/CVE-2023-29489","title":"Cappricio-Securities/CVE-2023-29489","date":"2024-04-21","url":"https://github.com/Cappricio-Securities/CVE-2023-29489"},{"source":"pocgithub","id":"Makurorororororororo/Validate-CVE-2023-29489-scanner-","title":"Makurorororororororo/Validate-CVE-2023-29489-scanner-","date":"2023-12-23","url":"https://github.com/Makurorororororororo/Validate-CVE-2023-29489-scanner-"},{"source":"pocgithub","id":"Mostafa-Elguerdawi/CVE-2023-29489","title":"Mostafa-Elguerdawi/CVE-2023-29489","date":"2023-04-29","url":"https://github.com/Mostafa-Elguerdawi/CVE-2023-29489"},{"source":"pocgithub","id":"S4muraiMelayu1337/CVE-2023-29489","title":"S4muraiMelayu1337/CVE-2023-29489","date":"2023-10-17","url":"https://github.com/S4muraiMelayu1337/CVE-2023-29489"},{"source":"pocgithub","id":"SynixCyberCrimeMy/CVE-2023-29489","title":"SynixCyberCrimeMy/CVE-2023-29489","date":"2023-11-16","url":"https://github.com/SynixCyberCrimeMy/CVE-2023-29489"},{"source":"pocgithub","id":"Thuankobtcode/CVE-2023-29489","title":"Thuankobtcode/CVE-2023-29489","date":"2025-06-05","url":"https://github.com/Thuankobtcode/CVE-2023-29489"},{"source":"pocgithub","id":"ViperM4sk/cpanel-xss-177","title":"ViperM4sk/cpanel-xss-177","date":"2023-08-04","url":"https://github.com/ViperM4sk/cpanel-xss-177"},{"source":"pocgithub","id":"ipk1/CVE-2023-29489.py","title":"ipk1/CVE-2023-29489.py","date":"2023-04-28","url":"https://github.com/ipk1/CVE-2023-29489.py"},{"source":"pocgithub","id":"learnerboy88/CVE-2023-29489","title":"learnerboy88/CVE-2023-29489","date":"2023-04-27","url":"https://github.com/learnerboy88/CVE-2023-29489"},{"source":"pocgithub","id":"md-thalal/CVE-2023-29489","title":"md-thalal/CVE-2023-29489","date":"2024-05-30","url":"https://github.com/md-thalal/CVE-2023-29489"},{"source":"pocgithub","id":"mdaseem03/cpanel_xss_2023","title":"mdaseem03/cpanel_xss_2023","date":"2024-01-23","url":"https://github.com/mdaseem03/cpanel_xss_2023"},{"source":"pocgithub","id":"prasad-1808/tool-29489","title":"prasad-1808/tool-29489","date":"2024-01-21","url":"https://github.com/prasad-1808/tool-29489"},{"source":"pocgithub","id":"some-man1/CVE-2023-29489","title":"some-man1/CVE-2023-29489","date":"2024-04-14","url":"https://github.com/some-man1/CVE-2023-29489"},{"source":"pocgithub","id":"whalebone7/EagleEye","title":"whalebone7/EagleEye","date":"2023-05-01","url":"https://github.com/whalebone7/EagleEye"},{"source":"pocgithub","id":"xKore123/cPanel-CVE-2023-29489","title":"xKore123/cPanel-CVE-2023-29489","date":"2023-04-27","url":"https://github.com/xKore123/cPanel-CVE-2023-29489"}],"products":[{"vendor":"cpanel","product":"cpanel"}],"references":[{"url":"https://forums.cpanel.net/threads/cpanel-tsr-2023-0001-full-disclosure.708949/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel/","tags":["x_transferred","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29489"},{"url":"https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel"},{"url":"https://forums.cpanel.net/threads/cpanel-tsr-2023-0001-full-disclosure.708949"},{"url":"https://github.com/advisories/GHSA-84fm-c8wr-cf69"}],"sources":{"cve":[{"id":"CVE-2023-29489","description":"An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.","status":"published","published":"2023-04-27T00:00:00Z","modified":"2024-08-02T14:07:46.446Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:L/A:L/C:L/I:L/PR:L/S:U/UI:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:28.643185Z"}],"euvd":[{"id":"EUVD-2023-33056","description":"An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.","status":"published","published":"2023-04-27T00:00:00Z","modified":"2024-08-02T14:07:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:L/A:L/C:L/I:L/PR:L/S:U/UI:N","level":"medium"}],"updated_at":"2026-11-03T03:50:05.51254Z"}],"ghsa":[{"id":"GHSA-84fm-c8wr-cf69","title":"An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page...","description":"An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.","status":"published","published":"2023-04-27T21:30:26Z","modified":"2024-04-04T03:43:07Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:56:17.471503Z"}],"nvd":[{"id":"CVE-2023-29489","description":"An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.","status":"published","published":"2023-04-27T21:15:10.783Z","modified":"2026-06-17T05:50:12.587Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:59.151142Z"}]}}