Priority LOW 23
HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload…
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00297 · Published 2026-07-10 · Fixed in 1.9.5 CWE-79
Priority MEDIUM 45
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidate…
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.03242 · Published 2026-07-10 · Fixed in 1.9.5 CWE-78
Priority HIGH 69
Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00303 · Published 2023-10-29 · Fixed in 1.8.9 CWE-268
Priority MEDIUM 60
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01293 · Published 2023-06-30 · Fixed in 1.7.8 CWE-79
Priority LOW 28
A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00604 · Published 2022-08-18 · No fix listed CWE-79
Priority MEDIUM 41
Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01362 · Published 2022-08-05 · Fixed in 1.6.6 CWE-94
Priority LOW 34
Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0131 · Published 2022-08-05 · Fixed in 1.6.6 CWE-266
Priority HIGH 69
OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.49269 · Published 2022-07-27 · Fixed in 1.6.5 CWE-78
Priority MEDIUM 50
Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.04532 · Published 2022-04-28 · Fixed in 1.5.12 CWE-77
Priority LOW 29
Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00868 · Published 2022-03-16 · Fixed in 1.5.11 CWE-79
Priority LOW 29
Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00967 · Published 2022-03-04 · Fixed in 1.5.9 CWE-79
Priority LOW 29
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01094 · Published 2022-03-04 · Fixed in 1.5.10 CWE-79
Priority LOW 29
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00834 · Published 2022-03-03 · Fixed in 1.5.9 CWE-79
Priority MEDIUM 44
hestiacp is vulnerable to Use of Wrong Operator in String Comparison
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01148 · Published 2021-09-15 · No fix listed CWE-597
Priority LOW 27
Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email me…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.01413 · Published 2021-02-16 · No fix listed
Priority LOW 33
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacke…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01853 · Published 2020-03-25 · No fix listed
THREATIST.IORead the docs