Cpanel
by CPanel
CVEs (413)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2008-1499 | 0.03 | — | 0.01 | Mar 25, 2008 | Cross-site scripting (XSS) vulnerability in frontend/x/manpage.html in cPanel 11.18.3 and 11.21.0-BETA allows remote attackers to inject arbitrary web script or HTML via the query string. | |||
| CVE-2007-4022 | 0.03 | — | 0.02 | Jul 26, 2007 | Cross-site scripting (XSS) vulnerability in frontend/x/htaccess/changepro.html in cPanel 10.9.1 allows remote attackers to inject arbitrary web script or HTML via the resname parameter. | |||
| CVE-2006-6523 | 0.03 | — | 0.02 | Dec 14, 2006 | Cross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter. | |||
| CVE-2006-5883 | 0.03 | — | 0.02 | Nov 14, 2006 | Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) dir parameter in (a) seldir.html, and the (2) user and (3) dir parameters in (b) newuser.html. | |||
| CVE-2006-5535 | 0.03 | — | 0.02 | Oct 26, 2006 | Multiple cross-site scripting (XSS) vulnerabilities in WebHostManager (WHM) 10.8.0 cPanel 10.9.0 R50 allow remote attackers to inject arbitrary web script or HTML via the (1) theme parameter to scripts/dosetmytheme and the (2) template parameter to scripts2/editzonetemplate. | |||
| CVE-2006-4293 | 0.03 | — | 0.02 | Aug 22, 2006 | Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the (2) file parameter in (a) editit.html or (b) showfile.html. | |||
| CVE-2006-3337 | 0.03 | — | 0.02 | Jul 3, 2006 | Cross-site scripting (XSS) vulnerability in frontend/x/files/select.html in cPanel 10.8.2-CURRENT 118 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter. | |||
| CVE-2005-2021 | 0.03 | — | 0.03 | Jun 20, 2005 | Cross-site scripting (XSS) vulnerability in cPanel 9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the user parameter in the login page. | |||
| CVE-2004-2308 | 0.03 | — | 0.02 | Dec 31, 2004 | Cross-site scripting (XSS) vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the dir parameter in dohtaccess.html. | |||
| CVE-2004-0490 | 0.03 | — | 0.04 | Aug 18, 2004 | cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the PATH_TRANSLATED variable, which allows local users to… | |||
| CVE-2004-1875 | 0.03 | — | 0.05 | Mar 30, 2004 | Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to… | |||
| CVE-2003-0521 | 0.03 | — | 0.02 | Aug 18, 2003 | Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the (1) Error Log or (2) Latest Visitors… | |||
| CVE-2020-26098 | 0.01 | — | 0.03 | Sep 25, 2020 | cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). | |||
| CVE-2025-66429 | 0.00 | — | 0.01 | Dec 11, 2025 | An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user. | |||
| CVE-2021-38586 | 0.00 | — | 0.00 | Aug 11, 2021 | In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589). | |||
| CVE-2021-38587 | 0.00 | — | 0.01 | Aug 11, 2021 | In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). | |||
| CVE-2021-38588 | 0.00 | — | 0.00 | Aug 11, 2021 | In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). | |||
| CVE-2021-38589 | 0.00 | — | 0.01 | Aug 11, 2021 | In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). | |||
| CVE-2021-38590 | 0.00 | — | 0.00 | Aug 11, 2021 | In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). | |||
| CVE-2021-31803 | 0.00 | — | 0.01 | Apr 26, 2021 | cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). |
- CVE-2008-1499Mar 25, 2008risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in frontend/x/manpage.html in cPanel 11.18.3 and 11.21.0-BETA allows remote attackers to inject arbitrary web script or HTML via the query string.
- CVE-2007-4022Jul 26, 2007risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in frontend/x/htaccess/changepro.html in cPanel 10.9.1 allows remote attackers to inject arbitrary web script or HTML via the resname parameter.
- CVE-2006-6523Dec 14, 2006risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter.
- CVE-2006-5883Nov 14, 2006risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) dir parameter in (a) seldir.html, and the (2) user and (3) dir parameters in (b) newuser.html.
- CVE-2006-5535Oct 26, 2006risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in WebHostManager (WHM) 10.8.0 cPanel 10.9.0 R50 allow remote attackers to inject arbitrary web script or HTML via the (1) theme parameter to scripts/dosetmytheme and the (2) template parameter to scripts2/editzonetemplate.
- CVE-2006-4293Aug 22, 2006risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the (2) file parameter in (a) editit.html or (b) showfile.html.
- CVE-2006-3337Jul 3, 2006risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in frontend/x/files/select.html in cPanel 10.8.2-CURRENT 118 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter.
- CVE-2005-2021Jun 20, 2005risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in cPanel 9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the user parameter in the login page.
- CVE-2004-2308Dec 31, 2004risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the dir parameter in dohtaccess.html.
- CVE-2004-0490Aug 18, 2004risk 0.03cvss —epss 0.04
cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the PATH_TRANSLATED variable, which allows local users to…
- CVE-2004-1875Mar 30, 2004risk 0.03cvss —epss 0.05
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to…
- CVE-2003-0521Aug 18, 2003risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the (1) Error Log or (2) Latest Visitors…
- CVE-2020-26098Sep 25, 2020risk 0.01cvss —epss 0.03
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).
- CVE-2025-66429Dec 11, 2025risk 0.00cvss —epss 0.01
An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.
- CVE-2021-38586Aug 11, 2021risk 0.00cvss —epss 0.00
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).
- CVE-2021-38587Aug 11, 2021risk 0.00cvss —epss 0.01
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
- CVE-2021-38588Aug 11, 2021risk 0.00cvss —epss 0.00
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
- CVE-2021-38589Aug 11, 2021risk 0.00cvss —epss 0.01
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).
- CVE-2021-38590Aug 11, 2021risk 0.00cvss —epss 0.00
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
- CVE-2021-31803Apr 26, 2021risk 0.00cvss —epss 0.01
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
Page 2 of 21