Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: hestiacp 1.9.5 Clear all filters
TI-2025-21383 CVE-2025-30008 · GHSA-w2cw-hx5v-f37r

HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface

Priority LOW 23

HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00297 Published 2026-07-10 Fixed in 1.9.5 CWE-79
TI-2025-21382 CVE-2025-30007 · GHSA-5c2f-7vp3-pm3x

HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management

Priority MEDIUM 45

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidate…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.03242 Published 2026-07-10 Fixed in 1.9.5 CWE-78