Cpanel
Monthly
Argument injection in WP Toolkit for cPanel allows local, low-privilege users with a valid hosting account to execute arbitrary code as other accounts on the same server. The vulnerability requires a multi-tenant deployment where untrusted local accounts coexist with WP Toolkit, as it is not remotely exploitable and needs no victim interaction. No public exploit code has been identified, but its high impact makes it a mid-to-high priority for shared and reseller hosting providers to patch promptly.
Stored cross-site scripting in the WHM Manage SSL Hosts interface of cPanel and WP Squared allows an authenticated attacker who can create or modify an SSL host entry to inject arbitrary script that executes in the browser of a higher-privileged operator - typically a server administrator - when that administrator later views the interface, giving the attacker arbitrary code execution in the victim's session context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) confirms the prerequisites: a prior authenticated foothold and administrator user interaction, which is a low barrier in multi-tenant or reseller hosting environments where low-privileged accounts are routine. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV); vendor-released patches are available in cPanel builds 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11 and WP Squared 11.138.1.13.
Stored cross-site scripting (XSS) in the WHM Mass Modify Accounts interface of cPanel and WP Squared allows an authenticated low-privilege WHM user (such as a reseller) to inject malicious script that executes when a higher-privileged operator views the affected interface, potentially leading to arbitrary code execution in the context of the victim's browser session. Affected versions include cPanel before 11.110.0.148, 11.134.0.61, 11.136.0.45, and 11.138.0.11, and WP Squared before 11.138.1.13. No public exploit identified at time of analysis, but vendor patches are available; the high CVSS score (9.0) is tempered by the requirement for an authenticated foothold and victim interaction.
OS command injection in cPanel and WP Squared allows an authenticated, low-privileged hosting account holder to execute arbitrary commands at server/root privilege by supplying insufficiently validated input to the Multilang adminbin. Tracked as CVE-2026-93698 (CVSS 9.9, scope-changed), the flaw affects cPanel builds before 11.138.0.11, 11.136.0.45, 11.134.0.61, and 11.110.0.148, as well as WP Squared before 11.138.1.13; vendor patches are available. No public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), but the scope-change to root privileges makes multi-tenant shared-hosting deployments the primary concern.
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows a remote authenticated (low-privileged, PR:L per the CVSS vector) customer account to read arbitrary files and execute arbitrary code, with the impact extending beyond the attacker's own account into other tenants hosted on the same cPanel server. Any standard shared-hosting customer login - including a self-registered or compromised account - is sufficient, requiring no user interaction and no elevated privileges, though the extension must be installed, enabled, and reachable on a version at or below 6.11.2-10794. There is no public exploit identified at time of analysis and the issue does not appear on CISA KEV; the defining risk amplifier is the multi-tenant scope change (S:C) rather than mass internet-wide exploitation.
Any holder of a valid low-privileged cPanel account can escalate to root and execute arbitrary code on the underlying host, because a privileged cPanel operation is executed with unnecessary root privileges (CWE-250). The flaw is remotely reachable over the network with low attack complexity and no user interaction, but it does require an authenticated account (CVSS 4.0 vector PR:L) - a trivial barrier on shared hosting where accounts are commonly sold or self-provisioned, and a meaningful one on locked-down single-tenant deployments. It carries a 9.4 CVSS 4.0 score and is rated a genuine high-priority issue rather than a high-score/low-real-risk case, though no public exploit code and no confirmed active exploitation were identified at time of analysis; no EPSS estimate was available in the supplied intelligence.
Incorrect permission assignment in the cPanel CalDAV/CardDAV service (CCS Calendar and Contacts) allows an authenticated low-privilege cPanel account on a multi-tenant or shared-hosting server to read calendar and contact data belonging to other hosting accounts. Exploitation requires an existing local foothold with a valid cPanel login on the same server (CVSS 4.0 AV:L/PR:L) and produces a confidentiality-only impact with a scope change, since the data exposed belongs to separate accounts rather than the attacker's own; integrity and availability are unaffected. There is no public exploit identified at time of analysis and the issue is a local permission-assignment defect rather than a remotely reachable flaw, so single-tenant deployments with only one account have no 'other accounts' to disclose and are effectively not exposed.
Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection flaw in the EmailTrack component. An authenticated low-privilege mailbox user can chain the injection into command execution as root, giving full server takeover; the vendor has shipped fixes across five maintenance branches and a HackerOne-sourced report confirms the issue, though no public exploit has been identified at time of analysis.
Eval injection in cPanel's Park API (versions 11.138.0.0 and earlier) enables remote authenticated users to execute arbitrary code with root-level privileges on affected hosting servers. The vulnerability, classified under CWE-95 (Eval Injection) and reported via HackerOne, was disclosed alongside a WebPros vendor advisory on August 27, 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the direct path to root execution across a widely deployed hosting platform makes this a critical remediation priority.
Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to preserve the active SQL mode, permitting a low-privileged authenticated hosting user to have SQL executed with root-level database privileges (CWE-89). This carries a CVSS 4.0 base score of 9.4 with a scope change to subsequent systems, and no public exploit has been identified at time of analysis. It is fixed in the cPanel 138 release series per the vendor advisory.
Denial of service in the Cpanel::JSON::XS Perl module before version 4.41 allows remote attackers to crash any caller that decodes a UTF-8 BOM prefixed JSON document with a throwing filter callback. The flaw arises from a missed pointer restoration when decode_json aborts via a Perl exception, leaving the input scalar with a corrupted SvPVX pointer that fatally aborts the interpreter on later free. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but CISA SSVC marks the issue as automatable with partial technical impact.
Type confusion in Cpanel::JSON::XS (Perl) versions before 4.41 allows remote attackers to crash a decoder by submitting JSON with duplicate object keys when the dupkeys_as_arrayref option is enabled. The decode_hv() routine dereferences a scalar as a reference before verifying its type, turning attacker-controlled scalar contents into a wild pointer access. No public exploit identified at time of analysis; EPSS is 0.02% and CISA SSVC marks exploitation as 'none' but automatable with partial technical impact.
Credential interception in cPanel/WHM and WP Squared DNS Cluster system allows network-positioned attackers to perform man-in-the-middle attacks because SSL/TLS certificate verification is disabled when DNS Cluster nodes communicate. An attacker able to intercept traffic between cluster peers can impersonate a legitimate DNS Cluster server and capture authentication credentials transmitted during the request. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%), but SSVC marks the flaw as automatable with partial technical impact.
Arbitrary file read in cPanel & WHM's cpdavd service allows remote unauthenticated attackers to retrieve sensitive files from the server through attachment download endpoints that fail to properly filter paths and enforce privilege boundaries. The flaw affects multiple supported cPanel release tiers (11.120 through 11.136) and WP Squared 11.120.1.0-11.136.1.12, scoring CVSS 8.6 due to network reach without authentication, though EPSS exploitation probability is only 0.04% and no public exploit identified at time of analysis.
SQL injection in the cPanel/WHM sqloptimizer utility script allows attackers to execute arbitrary SQL queries as the MySQL root user when Slow Query logging is enabled. The flaw affects multiple cPanel branches (11.86 through 11.136), WP Squared, and the CloudLinux 6/CentOS 6 builds, with no public exploit identified at time of analysis. EPSS is low (0.03%) and SSVC marks exploitation as 'none', but technical impact is rated total because the injection runs with full database privileges.
Privilege escalation in cPanel and WP Squared allows an authenticated team member account to elevate privileges to the team owner, granting full control over the hosting account. The flaw stems from improper authorization checks within the team-member privilege model and carries a CVSS 7.1 (high integrity impact). EPSS is very low (0.03%) and no public exploit has been identified at time of analysis, but a vendor patch is available.
Arbitrary file read in cPanel & WHM's `feature::LOADFEATUREFILE` adminbin call allows an attacker to disclose sensitive files by supplying a relative path that bypasses the feature-file name validation. The flaw affects multiple cPanel branches (11.86 through 11.136) as well as WP Squared and the CentOS 6/CloudLinux 6 builds, and was reported responsibly through HackerOne with a vendor patch issued May 8, 2026. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%), consistent with CISA SSVC scoring exploitation as 'none'.
HTTP request smuggling in cPanel and WP Squared (by WebPros) enables leakage of credentials from other users sharing the same hosting infrastructure. The CVSS 4.0 vector confirms network-reachable exploitation with no authentication required but with passive user interaction and attack-specific prerequisites; critically, the subsequent-system impact is rated High for both confidentiality and integrity (SC:H/SI:H), indicating that successful exploitation crosses trust boundaries to affect other users or backend components beyond the attacker's own session. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the scope-change impact makes it a meaningful risk in shared hosting environments where cPanel serves multiple tenants.
Arbitrary Perl code execution in cPanel and WP Squared via insufficient validation of the plugin parameter in the create_user plugin, allowing any authenticated user to execute arbitrary Perl code as their underlying system user account. Vendor-supplied CVSS 4.0 rates this Medium (5.3) with PR:L confirming authentication is required, while SSVC simultaneously rates Technical Impact as total - a notable discrepancy defenders should note. No public exploit has been identified and CISA has not added it to KEV; WebPros released patches across all affected branches on May 8, 2026.
Symlink following in cPanel's Nova plugin (Cpanel::Nova::Connector) allows any authenticated cPanel user to redirect a root-executed chmod to arbitrary filesystem paths by placing a symlink at a user-controlled legacy Nova path within their home directory. Affected are more than a dozen cPanel release trains spanning versions 11.86 through 11.136, plus WP Squared 11.136.x. No public exploit exists and EPSS stands at 0.04%, but CISA's SSVC framework rates the technical impact as total given the potential to set root-level permissions on critical system files, enabling local privilege escalation or denial of service in multi-tenant hosting environments.
Directory traversal in the cPanel Team Manager API allows an authenticated attacker holding a low-privilege Team Manager sub-account to overwrite arbitrary files on servers running cPanel versions 110 through 132, which can then be leveraged to escalate privileges to root. Exploitation requires valid team-level credentials and that the Team Manager feature is provisioned and reachable, but the flaw is low-complexity and needs no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), so once such an account exists the path to full compromise is straightforward. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the EPSS score is modest at 0.83% (56th percentile), but the file-overwrite-to-root outcome makes this a credible operational priority for any host provisioning Team Manager accounts.
An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589). Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567). Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The email quota cache in cPanel before 90.0.10 allows overwriting of files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478). Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474). Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472). Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415). Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481). Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477). Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495). Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Argument injection in WP Toolkit for cPanel allows local, low-privilege users with a valid hosting account to execute arbitrary code as other accounts on the same server. The vulnerability requires a multi-tenant deployment where untrusted local accounts coexist with WP Toolkit, as it is not remotely exploitable and needs no victim interaction. No public exploit code has been identified, but its high impact makes it a mid-to-high priority for shared and reseller hosting providers to patch promptly.
Stored cross-site scripting in the WHM Manage SSL Hosts interface of cPanel and WP Squared allows an authenticated attacker who can create or modify an SSL host entry to inject arbitrary script that executes in the browser of a higher-privileged operator - typically a server administrator - when that administrator later views the interface, giving the attacker arbitrary code execution in the victim's session context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) confirms the prerequisites: a prior authenticated foothold and administrator user interaction, which is a low barrier in multi-tenant or reseller hosting environments where low-privileged accounts are routine. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV); vendor-released patches are available in cPanel builds 11.110.0.148, 11.134.0.61, 11.136.0.45, 11.138.0.11 and WP Squared 11.138.1.13.
Stored cross-site scripting (XSS) in the WHM Mass Modify Accounts interface of cPanel and WP Squared allows an authenticated low-privilege WHM user (such as a reseller) to inject malicious script that executes when a higher-privileged operator views the affected interface, potentially leading to arbitrary code execution in the context of the victim's browser session. Affected versions include cPanel before 11.110.0.148, 11.134.0.61, 11.136.0.45, and 11.138.0.11, and WP Squared before 11.138.1.13. No public exploit identified at time of analysis, but vendor patches are available; the high CVSS score (9.0) is tempered by the requirement for an authenticated foothold and victim interaction.
OS command injection in cPanel and WP Squared allows an authenticated, low-privileged hosting account holder to execute arbitrary commands at server/root privilege by supplying insufficiently validated input to the Multilang adminbin. Tracked as CVE-2026-93698 (CVSS 9.9, scope-changed), the flaw affects cPanel builds before 11.138.0.11, 11.136.0.45, 11.134.0.61, and 11.110.0.148, as well as WP Squared before 11.138.1.13; vendor patches are available. No public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV), but the scope-change to root privileges makes multi-tenant shared-hosting deployments the primary concern.
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows a remote authenticated (low-privileged, PR:L per the CVSS vector) customer account to read arbitrary files and execute arbitrary code, with the impact extending beyond the attacker's own account into other tenants hosted on the same cPanel server. Any standard shared-hosting customer login - including a self-registered or compromised account - is sufficient, requiring no user interaction and no elevated privileges, though the extension must be installed, enabled, and reachable on a version at or below 6.11.2-10794. There is no public exploit identified at time of analysis and the issue does not appear on CISA KEV; the defining risk amplifier is the multi-tenant scope change (S:C) rather than mass internet-wide exploitation.
Any holder of a valid low-privileged cPanel account can escalate to root and execute arbitrary code on the underlying host, because a privileged cPanel operation is executed with unnecessary root privileges (CWE-250). The flaw is remotely reachable over the network with low attack complexity and no user interaction, but it does require an authenticated account (CVSS 4.0 vector PR:L) - a trivial barrier on shared hosting where accounts are commonly sold or self-provisioned, and a meaningful one on locked-down single-tenant deployments. It carries a 9.4 CVSS 4.0 score and is rated a genuine high-priority issue rather than a high-score/low-real-risk case, though no public exploit code and no confirmed active exploitation were identified at time of analysis; no EPSS estimate was available in the supplied intelligence.
Incorrect permission assignment in the cPanel CalDAV/CardDAV service (CCS Calendar and Contacts) allows an authenticated low-privilege cPanel account on a multi-tenant or shared-hosting server to read calendar and contact data belonging to other hosting accounts. Exploitation requires an existing local foothold with a valid cPanel login on the same server (CVSS 4.0 AV:L/PR:L) and produces a confidentiality-only impact with a scope change, since the data exposed belongs to separate accounts rather than the attacker's own; integrity and availability are unaffected. There is no public exploit identified at time of analysis and the issue is a local permission-assignment defect rather than a remotely reachable flaw, so single-tenant deployments with only one account have no 'other accounts' to disclose and are effectively not exposed.
Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection flaw in the EmailTrack component. An authenticated low-privilege mailbox user can chain the injection into command execution as root, giving full server takeover; the vendor has shipped fixes across five maintenance branches and a HackerOne-sourced report confirms the issue, though no public exploit has been identified at time of analysis.
Eval injection in cPanel's Park API (versions 11.138.0.0 and earlier) enables remote authenticated users to execute arbitrary code with root-level privileges on affected hosting servers. The vulnerability, classified under CWE-95 (Eval Injection) and reported via HackerOne, was disclosed alongside a WebPros vendor advisory on August 27, 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the direct path to root execution across a widely deployed hosting platform makes this a critical remediation priority.
Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to preserve the active SQL mode, permitting a low-privileged authenticated hosting user to have SQL executed with root-level database privileges (CWE-89). This carries a CVSS 4.0 base score of 9.4 with a scope change to subsequent systems, and no public exploit has been identified at time of analysis. It is fixed in the cPanel 138 release series per the vendor advisory.
Denial of service in the Cpanel::JSON::XS Perl module before version 4.41 allows remote attackers to crash any caller that decodes a UTF-8 BOM prefixed JSON document with a throwing filter callback. The flaw arises from a missed pointer restoration when decode_json aborts via a Perl exception, leaving the input scalar with a corrupted SvPVX pointer that fatally aborts the interpreter on later free. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but CISA SSVC marks the issue as automatable with partial technical impact.
Type confusion in Cpanel::JSON::XS (Perl) versions before 4.41 allows remote attackers to crash a decoder by submitting JSON with duplicate object keys when the dupkeys_as_arrayref option is enabled. The decode_hv() routine dereferences a scalar as a reference before verifying its type, turning attacker-controlled scalar contents into a wild pointer access. No public exploit identified at time of analysis; EPSS is 0.02% and CISA SSVC marks exploitation as 'none' but automatable with partial technical impact.
Credential interception in cPanel/WHM and WP Squared DNS Cluster system allows network-positioned attackers to perform man-in-the-middle attacks because SSL/TLS certificate verification is disabled when DNS Cluster nodes communicate. An attacker able to intercept traffic between cluster peers can impersonate a legitimate DNS Cluster server and capture authentication credentials transmitted during the request. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%), but SSVC marks the flaw as automatable with partial technical impact.
Arbitrary file read in cPanel & WHM's cpdavd service allows remote unauthenticated attackers to retrieve sensitive files from the server through attachment download endpoints that fail to properly filter paths and enforce privilege boundaries. The flaw affects multiple supported cPanel release tiers (11.120 through 11.136) and WP Squared 11.120.1.0-11.136.1.12, scoring CVSS 8.6 due to network reach without authentication, though EPSS exploitation probability is only 0.04% and no public exploit identified at time of analysis.
SQL injection in the cPanel/WHM sqloptimizer utility script allows attackers to execute arbitrary SQL queries as the MySQL root user when Slow Query logging is enabled. The flaw affects multiple cPanel branches (11.86 through 11.136), WP Squared, and the CloudLinux 6/CentOS 6 builds, with no public exploit identified at time of analysis. EPSS is low (0.03%) and SSVC marks exploitation as 'none', but technical impact is rated total because the injection runs with full database privileges.
Privilege escalation in cPanel and WP Squared allows an authenticated team member account to elevate privileges to the team owner, granting full control over the hosting account. The flaw stems from improper authorization checks within the team-member privilege model and carries a CVSS 7.1 (high integrity impact). EPSS is very low (0.03%) and no public exploit has been identified at time of analysis, but a vendor patch is available.
Arbitrary file read in cPanel & WHM's `feature::LOADFEATUREFILE` adminbin call allows an attacker to disclose sensitive files by supplying a relative path that bypasses the feature-file name validation. The flaw affects multiple cPanel branches (11.86 through 11.136) as well as WP Squared and the CentOS 6/CloudLinux 6 builds, and was reported responsibly through HackerOne with a vendor patch issued May 8, 2026. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%), consistent with CISA SSVC scoring exploitation as 'none'.
HTTP request smuggling in cPanel and WP Squared (by WebPros) enables leakage of credentials from other users sharing the same hosting infrastructure. The CVSS 4.0 vector confirms network-reachable exploitation with no authentication required but with passive user interaction and attack-specific prerequisites; critically, the subsequent-system impact is rated High for both confidentiality and integrity (SC:H/SI:H), indicating that successful exploitation crosses trust boundaries to affect other users or backend components beyond the attacker's own session. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the scope-change impact makes it a meaningful risk in shared hosting environments where cPanel serves multiple tenants.
Arbitrary Perl code execution in cPanel and WP Squared via insufficient validation of the plugin parameter in the create_user plugin, allowing any authenticated user to execute arbitrary Perl code as their underlying system user account. Vendor-supplied CVSS 4.0 rates this Medium (5.3) with PR:L confirming authentication is required, while SSVC simultaneously rates Technical Impact as total - a notable discrepancy defenders should note. No public exploit has been identified and CISA has not added it to KEV; WebPros released patches across all affected branches on May 8, 2026.
Symlink following in cPanel's Nova plugin (Cpanel::Nova::Connector) allows any authenticated cPanel user to redirect a root-executed chmod to arbitrary filesystem paths by placing a symlink at a user-controlled legacy Nova path within their home directory. Affected are more than a dozen cPanel release trains spanning versions 11.86 through 11.136, plus WP Squared 11.136.x. No public exploit exists and EPSS stands at 0.04%, but CISA's SSVC framework rates the technical impact as total given the potential to set root-level permissions on critical system files, enabling local privilege escalation or denial of service in multi-tenant hosting environments.
Directory traversal in the cPanel Team Manager API allows an authenticated attacker holding a low-privilege Team Manager sub-account to overwrite arbitrary files on servers running cPanel versions 110 through 132, which can then be leveraged to escalate privileges to root. Exploitation requires valid team-level credentials and that the Team Manager feature is provisioned and reachable, but the flaw is low-complexity and needs no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8), so once such an account exists the path to full compromise is straightforward. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the EPSS score is modest at 0.83% (56th percentile), but the file-overwrite-to-root outcome makes this a credible operational priority for any host provisioning Team Manager accounts.
An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589). Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567). Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The email quota cache in cPanel before 90.0.10 allows overwriting of files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478). Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474). Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472). Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415). Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481). Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477). Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495). Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.