Priority HIGH 72
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.00574 · Published 2026-10-16 · Fixed in 1.10.5 CWE-863
Priority HIGH 76
Hestia Control Panel is a lightweight and powerful control panel for the modern web.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00675 · Published 2026-10-14 · Fixed in 1.10.5 CWE-427
Priority LOW 23
HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload…
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00297 · Published 2026-07-10 · Fixed in 1.9.5 CWE-79
Priority MEDIUM 45
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidate…
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.03242 · Published 2026-07-10 · Fixed in 1.9.5 CWE-78
Priority HIGH 69
HestiaCP panel cronjob feature is affected by a broken access control vulnerability.
CVSS 4.0HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00396 · Published 2026-07-04 · Fixed CWE-287
Priority HIGH 77
HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00241 · Published 2026-05-19 · Fixed CWE-348
Priority HIGH 82
HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achi…
CVSS 4.0CRITICAL 9.5· Network · No auth · No interaction · EPSS 0.01072 · Published 2026-05-19 · Fixed CWE-502
Priority HIGH 69
Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00303 · Published 2023-10-29 · Fixed in 1.8.9 CWE-268
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00463 · Published 2023-10-13 · Fixed in 1.8.6 CWE-79
Priority MEDIUM 60
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00458 · Published 2023-09-20 · Fixed in 1.8.8 CWE-79
Priority MEDIUM 60
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01293 · Published 2023-06-30 · Fixed in 1.7.8 CWE-79
Priority LOW 28
A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00604 · Published 2022-08-18 · No fix listed CWE-79
Priority LOW 34
An issue was discovered in HestiaCP before v1.3.5.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00788 · Published 2022-08-18 · No fix listed
Priority MEDIUM 41
Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01362 · Published 2022-08-05 · Fixed in 1.6.6 CWE-94
Priority LOW 34
Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0131 · Published 2022-08-05 · Fixed in 1.6.6 CWE-266
Priority HIGH 69
OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.49269 · Published 2022-07-27 · Fixed in 1.6.5 CWE-78
Priority MEDIUM 50
Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.04532 · Published 2022-04-28 · Fixed in 1.5.12 CWE-77
Priority LOW 29
Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00868 · Published 2022-03-16 · Fixed in 1.5.11 CWE-79
Priority LOW 29
Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00967 · Published 2022-03-04 · Fixed in 1.5.9 CWE-79
Priority LOW 29
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01094 · Published 2022-03-04 · Fixed in 1.5.10 CWE-79
Priority LOW 29
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00834 · Published 2022-03-03 · Fixed in 1.5.9 CWE-79
Priority MEDIUM 44
hestiacp is vulnerable to Use of Wrong Operator in String Comparison
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01148 · Published 2021-09-15 · No fix listed CWE-597
Priority LOW 27
Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email me…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.01413 · Published 2021-02-16 · No fix listed
Priority LOW 33
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacke…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01853 · Published 2020-03-25 · No fix listed
THREATIST.IORead the docs