Priority HIGH 73
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00875 · Published 2026-09-01 · Fixed in 11.110.0.141, 11.134.0.53 +3 CWE-95
Priority MEDIUM 54
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.08373 · Published 2026-05-13 · Fixed in 11.136.0.10, 11.134.0.26 +5 CWE-250
Priority MEDIUM 41
SSL verification is disabled in the DNS Cluster system.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00252 · Published 2026-05-13 · Fixed in 11.136.0.10, 11.134.0.26 +4 CWE-295
Priority CRITICAL 99KEV
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.98527 · Published 2026-04-29 · Fixed in 11.86.0.41, 11.94.0.28 +10 CWE-306
Priority MEDIUM 42
An issue was discovered in cPanel 110 through 132.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00825 · Published 2025-12-11 · No fix listed CWE-22
Priority HIGH 65
An issue was discovered in cPanel before 11.109.9999.116.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.65533 · Published 2023-04-27 · No fix listed CWE-79
Priority LOW 33
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00863 · Published 2021-08-11 · No fix listed CWE-611
Priority LOW 34
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01033 · Published 2021-08-11 · No fix listed CWE-502
Priority LOW 20
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).
CVSS 3.1MEDIUM 4.4· Local · High privileges · No interaction · EPSS 0.00248 · Published 2021-08-11 · No fix listed
Priority LOW 34
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00643 · Published 2021-08-11 · No fix listed CWE-362
Priority LOW 36
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00442 · Published 2021-08-11 · No fix listed CWE-494
Priority LOW 37
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00855 · Published 2021-08-11 · No fix listed
Priority LOW 24
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00262 · Published 2021-08-11 · No fix listed CWE-732
Priority LOW 28
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00581 · Published 2021-04-26 · No fix listed CWE-79
Priority LOW 35
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0093 · Published 2021-01-26 · No fix listed
Priority LOW 35
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0093 · Published 2021-01-26 · No fix listed
Priority LOW 31
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01193 · Published 2020-11-27 · No fix listed CWE-307
Priority LOW 28
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00641 · Published 2020-11-27 · No fix listed CWE-79
Priority LOW 20
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).
CVSS 3.1MEDIUM 4.1· Network · Low privileges · User interaction · EPSS 0.00581 · Published 2020-11-27 · No fix listed CWE-838
Priority MEDIUM 48
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03005 · Published 2020-09-25 · No fix listed
Priority LOW 35
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01207 · Published 2020-09-25 · No fix listed
Priority MEDIUM 45
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01611 · Published 2020-09-25 · No fix listed
Priority MEDIUM 45
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01419 · Published 2020-09-25 · No fix listed CWE-287
Priority LOW 36
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01385 · Published 2020-09-25 · No fix listed
Priority LOW 36
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01313 · Published 2020-09-25 · No fix listed CWE-521
Load more
THREATIST.IORead the docs