Whmcs
Monthly
We need answer as JSON. Need carefully parse. We need only JSON object. Need synthesize. Let's inspect input. CVE-2026-67399. Description: Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code. CVSS 9.3 with CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N... CWE-502. EPSS 0.69% percentile 51. Patch available vendor. Reported by hackerone. CPE cpe:2.3:a:webpros:whmcs:*... tags RCE, Deserialization, Whmcs, Webpros. SSVC exploitation none, automatable yes, technical impact total. EUVD affected versions. References help.whmcs.com and NVD. Need output fields. We must use all data. Product name: WHMCS. 1-3 words only: "WHMCS" likely. Summary: Original synthesis not copy description. Start with specific impact verb and product. "Remote code execution in WHMCS 8.x/9.x before ..." Explain what, who, attacker can do. Mention if actively exploited (KEV not given -> no public exploit identified), POC? Not given. EPSS moderate/low 0.69% percentile 51. Need mention patch available. SSVC says none exploitation, automatable yes, technical total. Need not start "A vulnerability..." So start "Remote code execution in WHMCS 8.0.x and 9.0.x before..." or "Unsafe deserialization in WHMCS 8.0.x/9.0.x enables remote code execution..." Need 2-3 sentences. We can mention CVSS 9.3, CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N, etc, EPSS 0.69% (51st percentile) indicates below-average near median predicted exploit probability despite high severity. SSVC no active exploitation reported but automatable. Patch available. Technical_context: Explain underlying technology: WHMCS is a PHP-based web hosting management/billing platform by Webpros. Deserialization of untrusted data CWE-502 arises when application deserializes attacker-controlled serialized objects without validation, often in PHP unserialize() leading to object injection / magic methods, can achieve RCE. CPE cpe:2.3:a:webpros:whmcs
The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 29.2% and no vendor patch available.
Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
submitticket.php in WHMCompleteSolution (WHMCS) 5.03 allows remote attackers to inject arbitrary code into a subject field via crafted ticket data, a different vulnerability than CVE-2011-5061. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
We need answer as JSON. Need carefully parse. We need only JSON object. Need synthesize. Let's inspect input. CVE-2026-67399. Description: Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code. CVSS 9.3 with CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N... CWE-502. EPSS 0.69% percentile 51. Patch available vendor. Reported by hackerone. CPE cpe:2.3:a:webpros:whmcs:*... tags RCE, Deserialization, Whmcs, Webpros. SSVC exploitation none, automatable yes, technical impact total. EUVD affected versions. References help.whmcs.com and NVD. Need output fields. We must use all data. Product name: WHMCS. 1-3 words only: "WHMCS" likely. Summary: Original synthesis not copy description. Start with specific impact verb and product. "Remote code execution in WHMCS 8.x/9.x before ..." Explain what, who, attacker can do. Mention if actively exploited (KEV not given -> no public exploit identified), POC? Not given. EPSS moderate/low 0.69% percentile 51. Need mention patch available. SSVC says none exploitation, automatable yes, technical total. Need not start "A vulnerability..." So start "Remote code execution in WHMCS 8.0.x and 9.0.x before..." or "Unsafe deserialization in WHMCS 8.0.x/9.0.x enables remote code execution..." Need 2-3 sentences. We can mention CVSS 9.3, CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N, etc, EPSS 0.69% (51st percentile) indicates below-average near median predicted exploit probability despite high severity. SSVC no active exploitation reported but automatable. Patch available. Technical_context: Explain underlying technology: WHMCS is a PHP-based web hosting management/billing platform by Webpros. Deserialization of untrusted data CWE-502 arises when application deserializes attacker-controlled serialized objects without validation, often in PHP unserialize() leading to object injection / magic methods, can achieve RCE. CPE cpe:2.3:a:webpros:whmcs
The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 29.2% and no vendor patch available.
Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
submitticket.php in WHMCompleteSolution (WHMCS) 5.03 allows remote attackers to inject arbitrary code into a subject field via crafted ticket data, a different vulnerability than CVE-2011-5061. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.