Cpanel vulnerabilities

Products

• Cpanel 421
• Webhost Manager 5
• Whm 5
• Cgiecho 3
• Cgiemail 3
• Wp Squared 3

Newest

• cpanel Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute... CVE-2026-65643 Public exploit 8.7 HighSeptember 1, 2026
• cpanel, cpanel whm, wp squared +2 more SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server... CVE-2026-32992 8.2 HighMay 13, 2026
• cpanel, cpanel whm, wp squared +2 more Incorrect privileges management and insufficient path filtering allow to read arbitrary file on... CVE-2026-29205 8.6 HighMay 13, 2026
• cpanel, cpanel whm, wp squared +1 more +3 more WebPros cPanel and WHM Authentication Bypass via Login Flow CVE-2026-41940 In KEVPublic exploit EPSS 98.5% 9.3 CriticalApril 29, 2026
• cpanel An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the... CVE-2025-66429 8.8 HighDecember 11, 2025
• cpanel, rurban cpanel\ +1 more The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that... CVE-2022-48623 Fix available 9.1 CriticalFebruary 13, 2024
• cpanel An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page... CVE-2023-29489 Public exploit EPSS 65.5% 5.3 MediumApril 27, 2023
• cpanel The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). CVE-2021-38584 7.2 HighAugust 11, 2021
• cpanel The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). CVE-2021-38585 7.2 HighAugust 11, 2021
• cpanel In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589). CVE-2021-38586 4.4 MediumAugust 11, 2021
• cpanel In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC... CVE-2021-38587 7.5 HighAugust 11, 2021
• cpanel In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC... CVE-2021-38588 8.1 HighAugust 11, 2021
• cpanel In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of... CVE-2021-38589 8.1 HighAugust 11, 2021
• cpanel In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). CVE-2021-38590 5.5 MediumAugust 11, 2021
• cpanel cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). CVE-2021-31803 6.1 MediumApril 26, 2021
• cpanel cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578). CVE-2021-26266 7.5 HighJanuary 26, 2021
• cpanel cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass... CVE-2021-26267 7.5 HighJanuary 26, 2021
• cpanel In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). CVE-2020-29136 6.5 MediumNovember 27, 2020
• cpanel cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577). CVE-2020-29137 6.1 MediumNovember 27, 2020
• cpanel cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567). CVE-2020-29135 4.1 MediumNovember 27, 2020
• cpanel cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). CVE-2020-26098 9.8 CriticalSeptember 25, 2020
• cpanel cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491). CVE-2020-26099 7.5 HighSeptember 25, 2020
• cpanel chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). CVE-2020-26100 9.8 CriticalSeptember 25, 2020
• cpanel In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). CVE-2020-26101 9.8 CriticalSeptember 25, 2020
• cpanel In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM ... CVE-2020-26102 7.5 HighSeptember 25, 2020
• cpanel In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551). CVE-2020-26103 7.5 HighSeptember 25, 2020
• cpanel In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552). CVE-2020-26104 7.5 HighSeptember 25, 2020
• cpanel In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). CVE-2020-26105 9.8 CriticalSeptember 25, 2020
• cpanel cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC... CVE-2020-26106 7.5 HighSeptember 25, 2020
• cpanel cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561). CVE-2020-26107 7.5 HighSeptember 25, 2020
• cpanel cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). CVE-2020-26108 9.8 CriticalSeptember 25, 2020
• cpanel cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package... CVE-2020-26109 7.5 HighSeptember 25, 2020
• cpanel cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564). CVE-2020-26110 6.1 MediumSeptember 25, 2020
• cpanel cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566). CVE-2020-26111 6.1 MediumSeptember 25, 2020
• cpanel The email quota cache in cPanel before 90.0.10 allows overwriting of files. CVE-2020-26112 7.5 HighSeptember 25, 2020
• cpanel cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569). CVE-2020-26113 6.1 MediumSeptember 25, 2020
• cpanel cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573). CVE-2020-26114 6.1 MediumSeptember 25, 2020
• cpanel cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574). CVE-2020-26115 6.1 MediumSeptember 25, 2020
• cpanel cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the... CVE-2020-12785 8.1 HighMay 11, 2020
• cpanel cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log... CVE-2020-12784 5.3 MediumMay 11, 2020
• cpanel cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547). CVE-2020-10122 6.5 MediumMarch 17, 2020
• cpanel cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC... CVE-2020-10121 9.8 CriticalMarch 17, 2020
• cpanel cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd... CVE-2020-10120 7.2 HighMarch 17, 2020
• cpanel cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync... CVE-2020-10119 9.8 CriticalMarch 17, 2020
• cpanel cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). CVE-2020-10118 9.1 CriticalMarch 17, 2020
• cpanel cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). CVE-2020-10117 9.1 CriticalMarch 17, 2020
• cpanel cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo... CVE-2020-10116 5.3 MediumMarch 17, 2020
• cpanel cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via... CVE-2020-10115 7.2 HighMarch 17, 2020
• cpanel cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535). CVE-2020-10114 6.1 MediumMarch 17, 2020
• cpanel cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515). CVE-2020-10113 6.1 MediumMarch 17, 2020
• Show olderLoading…