Read the docs

hestiacp

Records24All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

hestiacp records in CISA KEV

No hestiacp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Control Panel 16 records HIGH Hestiacp 3 records MEDIUM

Records

16 records in Control Panel · all components

TI-2023-05375 CVE-2023-5839 · GHSA-gg6v-f3wc-f9fg

Privilege Chaining in hestiacp/hestiacp

Priority HIGH 69

Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00303 Published 2023-10-29 Fixed in 1.8.9 CWE-268
TI-2022-02355 CVE-2022-2550 · GHSA-54c2-vr3w-mp8p

OS Command Injection in hestiacp/hestiacp

Priority HIGH 69

OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.49269 Published 2022-07-27 Fixed in 1.6.5 CWE-78
TI-2022-01382 CVE-2022-1509 · GHSA-99wp-pqm6-2vh4

Command Injection Vulnerability in hestiacp/hestiacp

Priority MEDIUM 50

Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.04532 Published 2022-04-28 Fixed in 1.5.12 CWE-77
TI-2025-21382 CVE-2025-30007 · GHSA-5c2f-7vp3-pm3x

HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management

Priority MEDIUM 45

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidate…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.03242 Published 2026-07-10 Fixed in 1.9.5 CWE-78
TI-2022-02437 CVE-2022-2636 · GHSA-6jj2-jrr7-fmxq

Code Injection in hestiacp/hestiacp

Priority MEDIUM 41

Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01362 Published 2022-08-05 Fixed in 1.6.6 CWE-94
TI-2022-02428 CVE-2022-2626 · GHSA-v9r4-jmp3-ch5f

Incorrect Privilege Assignment in hestiacp/hestiacp

Priority LOW 34

Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0131 Published 2022-08-05 Fixed in 1.6.6 CWE-266
TI-2021-08772 CVE-2021-27231 · GHSA-g29r-mmqp-whm4

Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows…

Priority LOW 27

Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email me…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.01413 Published 2021-02-16 No fix listed
TI-2025-21383 CVE-2025-30008 · GHSA-w2cw-hx5v-f37r

HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface

Priority LOW 23

HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00297 Published 2026-07-10 Fixed in 1.9.5 CWE-79
Open these records in search →