Hestiacp vulnerabilities

Products

• Control Panel 16
• Hestiacp/hestiacp 13
• Hestiacp 12

Newest

• hestiacp HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation CVE-2026-111627 8.6 HighOctober 16, 2026
• hestiacp HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking CVE-2026-108390 9.9 CriticalOctober 14, 2026
• hestiacp, hestiacp control panel +1 more HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface CVE-2025-30008 5.1 MediumJuly 10, 2026
• hestiacp, hestiacp control panel +1 more HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management CVE-2025-30007 8.7 HighJuly 10, 2026
• hestiacp HestiaCP Admin Takeover CVE-2026-12196 8.3 HighJuly 4, 2026
• hestiacp HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header CVE-2026-43634 8.7 HighMay 19, 2026
• hestiacp HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal CVE-2026-43633 9.5 CriticalMay 19, 2026
• hestiacp, hestiacp hestiacp/hestiacp, control panel +2 more Privilege Chaining in hestiacp/hestiacp CVE-2023-5839 8.8 HighOctober 29, 2023
• hestiacp, hestiacp hestiacp/hestiacp +1 more Cross-site Scripting (XSS) - Stored in hestiacp/hestiacp CVE-2023-4517 3.2 LowOctober 13, 2023
• hestiacp, hestiacp hestiacp/hestiacp +1 more Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp CVE-2023-5084 3.9 LowSeptember 20, 2023
• hestiacp, hestiacp hestiacp/hestiacp, control panel +2 more Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp CVE-2023-3479 4.3 MediumJune 30, 2023
• hestiacp control panel A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5... CVE-2021-30071 6.1 MediumAugust 18, 2022
• hestiacp An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install... CVE-2021-30070 7.5 HighAugust 18, 2022
• hestiacp hestiacp/hestiacp, control panel +1 more Code Injection in hestiacp/hestiacp CVE-2022-2636 8.5 HighAugust 5, 2022
• hestiacp hestiacp/hestiacp, control panel +1 more Incorrect Privilege Assignment in hestiacp/hestiacp CVE-2022-2626 9.1 CriticalAugust 5, 2022
• hestiacp hestiacp/hestiacp, control panel +1 more OS Command Injection in hestiacp/hestiacp CVE-2022-2550 EPSS 49.3% 9.9 CriticalJuly 27, 2022
• hestiacp hestiacp/hestiacp, control panel +1 more Command Injection Vulnerability in hestiacp/hestiacp CVE-2022-1509 9.9 CriticalApril 28, 2022
• hestiacp hestiacp/hestiacp, control panel +1 more Reflected Cross-site Scripting (XSS) Vulnerability in hestiacp/hestiacp CVE-2022-0986 2.4 LowMarch 16, 2022
• hestiacp hestiacp/hestiacp, control panel +1 more Cross-site Scripting (XSS) - Generic in hestiacp/hestiacp CVE-2022-0752 3.5 LowMarch 4, 2022
• hestiacp hestiacp/hestiacp, control panel +1 more Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp CVE-2022-0838 6.6 MediumMarch 4, 2022
• hestiacp hestiacp/hestiacp, control panel +1 more Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp CVE-2022-0753 3.5 LowMarch 3, 2022
• hestiacp hestiacp/hestiacp, control panel +1 more Use of Wrong Operator in String Comparison in hestiacp/hestiacp CVE-2021-3797 4.8 MediumSeptember 15, 2021
• hestiacp control panel Hestia Control Panel through 1.3.3, in a shared-hosting environment, sometimes allows remote... CVE-2021-27231 5.4 MediumFebruary 16, 2021
• hestiacp control panel In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel... CVE-2020-10966 6.5 MediumMarch 25, 2020