Cpanel

Records429All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical21CVSS 9.0–10.0

CVSS high109CVSS 7.0–8.9

Exploited now

Cpanel records in CISA KEV

TI-2026-30342 WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability CRITICAL 99KEV 2026-04-30

Components

Products in the NVD configurations · select one to filter the records

Cpanel 420 records CRITICAL Webhost Manager 5 records MEDIUM Whm 5 records CRITICAL Cgiecho 3 records LOW Cgiemail 3 records LOW Wp Squared 3 records CRITICAL

Records

429 records

TI-2026-30342 CVE-2026-41940 · GHSA-85qr-8rxc-62gv

WebPros cPanel and WHM Authentication Bypass via Login Flow

CRITICAL 99KEV

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.98527 Published 2026-04-29 Fixed in 11.86.0.41, 11.94.0.28 +10 CWE-306

TI-2026-46792 CVE-2026-65643 · GHSA-3x5r-hcq6-ggfv

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

HIGH 73

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00875 Published 2026-09-01 Fixed in 11.110.0.141, 11.134.0.53 +3 CWE-95

TI-2004-01645 CVE-2004-1769 · GHSA-wm2x-pgq2-vxxm

The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build…

HIGH 68

The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.34833 Published 2005-03-10 No fix listed

TI-2023-13860 CVE-2023-29489 · GHSA-84fm-c8wr-cf69

An issue was discovered in cPanel before 11.109.9999.116.

HIGH 65

An issue was discovered in cPanel before 11.109.9999.116.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.65533 Published 2023-04-27 No fix listed CWE-79

TI-2003-01325 CVE-2003-1425 · GHSA-p985-7qhp-pf5j

guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.

MEDIUM 56

guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.11483 Published 2007-10-20 No fix listed CWE-20

TI-2004-01646 CVE-2004-1770 · GHSA-gmc2-7xvp-vj74

The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to…

MEDIUM 55

The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.10222 Published 2005-03-10 No fix listed

TI-2026-23322 CVE-2026-29205 · GHSA-cc7w-h7g4-gq6p

Incorrect privileges management and insufficient path filtering allow to read arbitrary…

MEDIUM 54

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.08373 Published 2026-05-13 Fixed in 11.136.0.10, 11.134.0.26 +5 CWE-250

TI-2020-15941 CVE-2020-26098 · GHSA-cxw8-vqfr-fp3q

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).

MEDIUM 48

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03005 Published 2020-09-25 No fix listed

TI-2020-15951 CVE-2020-26108 · GHSA-cg6f-88f9-rp7x

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).

MEDIUM 47

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02475 Published 2020-09-25 No fix listed

TI-2018-14825 CVE-2018-20863 · GHSA-7v54-f8p4-435j

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).

MEDIUM 47

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02314 Published 2019-07-30 No fix listed CWE-20

TI-2016-08896 CVE-2016-10858 · GHSA-c3mx-q6g9-vrgq

cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).

MEDIUM 47

cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02502 Published 2019-08-01 No fix listed CWE-20

TI-2016-08893 CVE-2016-10855 · GHSA-hcf7-jg5c-2v6q

cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).

MEDIUM 47

cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02576 Published 2019-08-01 No fix listed CWE-20

TI-2016-08862 CVE-2016-10824 · GHSA-w6r6-7gh3-jg4c

cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90).

MEDIUM 47

cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02502 Published 2019-08-01 No fix listed CWE-20

TI-2006-04830 CVE-2006-5014 · GHSA-cj38-v6qv-2jpj

Unspecified vulnerability in cPanel before 10.9.0 12 Tree allows remote authenticated…

MEDIUM 47

Unspecified vulnerability in cPanel before 10.9.0 12 Tree allows remote authenticated users to gain privileges via unspecified vectors in (1) mysqladmin and (2) hooksadmin.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04048 Published 2006-09-27 No fix listed CWE-276

TI-2004-01750 CVE-2004-1875 · GHSA-pfjc-pqq8-xrjh

Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote…

MEDIUM 47

Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3)…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0456 Published 2005-05-10 No fix listed CWE-79

TI-2020-08178 CVE-2020-10121 · GHSA-wp65-xm2g-252m

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).

MEDIUM 46

cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01807 Published 2020-03-17 No fix listed

TI-2020-08176 CVE-2020-10119 · GHSA-m9cj-h7p6-2gpw

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).

MEDIUM 46

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02232 Published 2020-03-17 No fix listed

TI-2020-15948 CVE-2020-26105 · GHSA-59g5-964j-wr4j

In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).

MEDIUM 45

In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01419 Published 2020-09-25 No fix listed CWE-287

TI-2020-15944 CVE-2020-26101 · GHSA-qm8x-mfrg-qj65

In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).

MEDIUM 45

In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01419 Published 2020-09-25 No fix listed CWE-287

TI-2020-15943 CVE-2020-26100 · GHSA-5jp3-j2j9-56cp

chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).

MEDIUM 45

chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01611 Published 2020-09-25 No fix listed

TI-2019-14724 CVE-2019-20498 · GHSA-7rx9-g6fq-h3qc

cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).

MEDIUM 45

cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01597 Published 2020-03-17 No fix listed

TI-2016-08855 CVE-2016-10817 · GHSA-4fxx-xm73-m54q

cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).

MEDIUM 45

cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01635 Published 2019-08-01 No fix listed CWE-89

TI-2018-14849 CVE-2018-20887 · GHSA-4m9j-f935-mjmr

cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

MEDIUM 44

cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0106 Published 2019-08-01 No fix listed CWE-89

TI-2008-02370 CVE-2008-2478 · GHSA-qp94-gr87-4wq3

scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier…

MEDIUM 44

scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address fiel…

CVSS 2.0HIGH 8.5 Network Low privileges Interaction — EPSS 0.04213 Published 2008-05-28 No fix listed CWE-94

TI-2016-08866 CVE-2016-10828 · GHSA-67r6-482v-23v2

cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).

MEDIUM 43

cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02618 Published 2019-08-01 No fix listed CWE-22

Open these records in search →