Cpanel
by CPanel
CVEs (424)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-10857 | Med | 0.42 | 6.5 | 0.01 | Aug 1, 2019 | cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60). | ||
| CVE-2016-10856 | Med | 0.42 | 6.5 | 0.01 | Aug 1, 2019 | cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29). | ||
| CVE-2016-10852 | Med | 0.42 | 6.5 | 0.01 | Aug 1, 2019 | cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85). | ||
| CVE-2018-20883 | Med | 0.42 | 6.5 | 0.01 | Aug 1, 2019 | cPanel before 74.0.8 allows FTP access during account suspension (SEC-449). | ||
| CVE-2018-20864 | Med | 0.42 | 6.5 | 0.01 | Jul 30, 2019 | cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454). | ||
| CVE-2017-18469 | Med | 0.41 | 6.3 | 0.01 | Aug 5, 2019 | cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233). | ||
| CVE-2017-18468 | Med | 0.41 | 6.3 | 0.01 | Aug 5, 2019 | cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232). | ||
| CVE-2017-18447 | Med | 0.41 | 6.3 | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251). | ||
| CVE-2017-18446 | Med | 0.41 | 6.3 | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250). | ||
| CVE-2017-18439 | Med | 0.41 | 6.3 | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243). | ||
| CVE-2017-18438 | Med | 0.41 | 6.3 | 0.01 | Aug 2, 2019 | cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242). | ||
| CVE-2017-18403 | Med | 0.41 | 6.3 | 0.01 | Aug 2, 2019 | cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337). | ||
| CVE-2017-18389 | Med | 0.41 | 6.3 | 0.01 | Aug 2, 2019 | cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318). | ||
| CVE-2018-20931 | Med | 0.41 | 6.3 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405). | ||
| CVE-2018-20912 | Med | 0.41 | 6.3 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362). | ||
| CVE-2018-20879 | Med | 0.41 | 6.3 | 0.01 | Aug 1, 2019 | cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444). | ||
| CVE-2023-29489 | Med | 0.40 | 5.3 | 0.66 | Apr 27, 2023 | An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. | ||
| CVE-2021-31803 | Med | 0.40 | 6.1 | 0.01 | Apr 26, 2021 | cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). | ||
| CVE-2020-29137 | Med | 0.40 | 6.1 | 0.01 | Nov 27, 2020 | cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577). | ||
| CVE-2020-26115 | Med | 0.40 | 6.1 | 0.01 | Sep 25, 2020 | cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574). |
- risk 0.42cvss 6.5epss 0.01
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).
- risk 0.42cvss 6.5epss 0.01
cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).
- risk 0.42cvss 6.5epss 0.01
cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).
- risk 0.42cvss 6.5epss 0.01
cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).
- risk 0.42cvss 6.5epss 0.01
cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).
- risk 0.41cvss 6.3epss 0.01
cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).
- risk 0.41cvss 6.3epss 0.01
cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).
- risk 0.41cvss 6.3epss 0.01
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).
- risk 0.41cvss 6.3epss 0.01
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).
- risk 0.41cvss 6.3epss 0.01
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).
- risk 0.41cvss 6.3epss 0.01
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
- risk 0.41cvss 6.3epss 0.01
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).
- risk 0.41cvss 6.3epss 0.01
cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).
- risk 0.41cvss 6.3epss 0.01
cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405).
- risk 0.41cvss 6.3epss 0.01
cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362).
- risk 0.41cvss 6.3epss 0.01
cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).
- risk 0.40cvss 5.3epss 0.66
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.
- risk 0.40cvss 6.1epss 0.01
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
- risk 0.40cvss 6.1epss 0.01
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
- risk 0.40cvss 6.1epss 0.01
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).
Page 9 of 22