Whmcs
Monthly
Remote code execution in WebPros WHMCS allows unauthenticated network attackers to run arbitrary code on affected installations by feeding crafted serialized data into a code path that deserializes untrusted input (CWE-502). All WHMCS builds from 9.0.0 up to (but not including) 9.0.8, and from 8.0.0 up to (but not including) 8.13.7, are affected; the vendor vector (PR:N/UI:N/AC:L) indicates no authentication or user interaction is required and that default configurations may be exposed, although the specific vulnerable endpoint or feature is not named in the advisory. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation: none and EPSS is 0.69% (51st percentile), but the SSVC Technical Impact is rated total and Automatable is yes, so patching should be treated as high priority.
The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 29.2% and no vendor patch available.
Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
submitticket.php in WHMCompleteSolution (WHMCS) 5.03 allows remote attackers to inject arbitrary code into a subject field via crafted ticket data, a different vulnerability than CVE-2011-5061. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in WebPros WHMCS allows unauthenticated network attackers to run arbitrary code on affected installations by feeding crafted serialized data into a code path that deserializes untrusted input (CWE-502). All WHMCS builds from 9.0.0 up to (but not including) 9.0.8, and from 8.0.0 up to (but not including) 8.13.7, are affected; the vendor vector (PR:N/UI:N/AC:L) indicates no authentication or user interaction is required and that default configurations may be exposed, although the specific vulnerable endpoint or feature is not named in the advisory. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation: none and EPSS is 0.69% (51st percentile), but the SSVC Technical Impact is rated total and Automatable is yes, so patching should be treated as high priority.
The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 29.2% and no vendor patch available.
Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
submitticket.php in WHMCompleteSolution (WHMCS) 5.03 allows remote attackers to inject arbitrary code into a subject field via crafted ticket data, a different vulnerability than CVE-2011-5061. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.