Skip to contentCpanel vulnerabilities
Newest
- cpanelcPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is...CVE-2019-204989.8 Critical
- cpanelcPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).CVE-2019-204975.4 Medium
- cpanelcPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log...CVE-2019-204965.5 Medium
- cpanelcPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming ...CVE-2019-204956.5 Medium
- cpanelIn cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).CVE-2019-204943.3 Low
- cpanelcPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).CVE-2019-204936.1 Medium
- cpanelcPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the...CVE-2019-204928.8 High
- cpanelcPanel before 82.0.18 allows authentication bypass because webmail usernames are processed...CVE-2019-204908.8 High
- cpanelcPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass...CVE-2019-204915.4 Medium
- cpanel, cpanel whm +1 moreThe clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS...CVE-2012-64495.4 Medium
- cpanel webhost managerCross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to...CVE-2012-6448Public exploit6.1 Medium
- cpanelcPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).CVE-2019-173806.1 Medium
- cpanelcPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).CVE-2019-173796.1 Medium
- cpanelcPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).CVE-2019-173786.1 Medium
- cpanelcPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).CVE-2019-173776.1 Medium
- cpanelcPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).CVE-2019-173766.1 Medium
- cpanelcPanel before 82.0.15 allows API token credentials to persist after an account has been renamed...CVE-2019-173758.8 High
- cpanelIn cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).CVE-2016-108128.8 High
- cpanelIn cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).CVE-2016-108118.8 High
- cpanelIn cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process ...CVE-2016-108108.8 High
- cpanelIn cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process ...CVE-2016-108098.8 High
- cpanelIn cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).CVE-2016-108088.8 High
- cpanelcPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC...CVE-2016-108076.5 Medium
- cpanelcPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).CVE-2016-108065.4 Medium
- cpanelcPanel before 57.9999.54 allows demo accounts to execute arbitrary code via...CVE-2016-108058.8 High
- cpanelThe SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations...CVE-2016-108048.1 High
- cpanelcPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).CVE-2016-108037.5 High
- cpanelcPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP...CVE-2016-108028.8 High
- cpanelcPanel before 58.0.4 has improper session handling for shared users (SEC-139).CVE-2016-108018.8 High
- cpanelcPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138).CVE-2016-108007.8 High
- cpanelcPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).CVE-2016-107995.5 Medium
- cpanelcPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).CVE-2016-107986.8 Medium
- cpanelcPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list...CVE-2016-107974.3 Medium
- cpanelcPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).CVE-2016-107963.3 Low
- cpanelcPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).CVE-2016-107956.1 Medium
- cpanelcPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form...CVE-2016-107946.5 Medium
- cpanelcPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF...CVE-2016-107938.8 High
- cpanelcPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list...CVE-2016-107928.8 High
- cpanelcPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins...CVE-2016-107915.3 Medium
- cpanelcPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).CVE-2016-107907.5 High
- cpanelcPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191).CVE-2016-107898.8 High
- cpanelcPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188).CVE-2016-107888.8 High
- cpanelThe Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries ...CVE-2016-107878.1 High
- cpanelcPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC...CVE-2016-107866.5 Medium
- cpanelcPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC...CVE-2016-107856.5 Medium
- cpanelcPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).CVE-2016-107845.4 Medium
- cpanelcPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).CVE-2016-107835.4 Medium
- cpanelcPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181).CVE-2016-107825.4 Medium
- cpanelcPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180).CVE-2016-107815.4 Medium
- cpanelcPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180).CVE-2016-107805.4 Medium
- Show moreLoading…