VYPR
← CPanel

Vendor CVEs

CPanel

All CVEs

446 total · sorted by risk
  • CVE-2018-20893LowAug 1, 2019
    CPanel
    Cpanel
    risk 0.15cvss 2.3epss 0.00

    cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442).

  • CVE-2017-18392LowAug 2, 2019
    CPanel
    Cpanel
    risk 0.13cvss 2.0epss 0.01

    cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325).

  • CVE-2004-1769Mar 11, 2004
    CPanel
    Cpanel
    risk 0.05cvss —epss 0.35

    The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.

  • CVE-2008-6843Jul 2, 2009
    CPanel
    Cpanel
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a .. (dot dot) in the sup3r parameter.

  • CVE-2007-1455Mar 14, 2007
    CPanel
    Fantastico De Luxe
    risk 0.04cvss —epss 0.07

    Multiple absolute path traversal vulnerabilities in Fantastico, as used with cPanel 10.x, allow remote authenticated users to include and execute arbitrary local files via (1) the userlanguage parameter to includes/load_language.php or (2) the fantasticopath parameter to…

  • CVE-2004-1770Mar 11, 2004
    CPanel
    Cpanel
    risk 0.04cvss —epss 0.10

    The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter.

  • CVE-2003-1425Dec 31, 2003
    CPanel
    Cpanel
    risk 0.04cvss —epss 0.11

    guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.

  • CVE-2009-4823Apr 27, 2010
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in frontend/x3/files/fileop.html in cPanel 11.0 through 11.24.7 allows remote attackers to inject arbitrary web script or HTML via the fileop parameter.

  • CVE-2008-7142Sep 1, 2009
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.03

    Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers to list arbitrary directories via the showtree parameter.

  • CVE-2008-6927Aug 10, 2009
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary web script or HTML via the (1) localapp, (2) updatedir, (3) scriptpath_show, (4) domain_show, (5)…

  • CVE-2008-6926Aug 10, 2009
    CPanel
    Fantastico De Luxe
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the scriptpath_show parameter in a GoAhead action. …

  • CVE-2009-2275Jul 1, 2009
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.04

    Directory traversal vulnerability in frontend/x3/stats/lastvisit.html in cPanel allows remote attackers to read arbitrary files via a .. (dot dot) in the domain parameter.

  • CVE-2008-2478May 28, 2008
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.04

    scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this,…

  • CVE-2008-2070May 12, 2008
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the (1) issue parameter to scripts2/knowlegebase,…

  • CVE-2008-1499Mar 25, 2008
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in frontend/x/manpage.html in cPanel 11.18.3 and 11.21.0-BETA allows remote attackers to inject arbitrary web script or HTML via the query string.

  • CVE-2007-4022Jul 26, 2007
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in frontend/x/htaccess/changepro.html in cPanel 10.9.1 allows remote attackers to inject arbitrary web script or HTML via the resname parameter.

  • CVE-2007-0890Feb 12, 2007
    CPanel
    Webhost Manager
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in scripts/passwdmysql in cPanel WebHost Manager (WHM) 11.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the password parameter.

  • CVE-2006-6523Dec 14, 2006
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter.

  • CVE-2006-6198Dec 1, 2006
    CPanel
    Webhost Manager
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) email parameter to (a) scripts2/dochangeemail, the (2) supporturl parameter to (b)…

  • CVE-2006-5883Nov 14, 2006
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) dir parameter in (a) seldir.html, and the (2) user and (3) dir parameters in (b) newuser.html.

  • CVE-2006-5535Oct 26, 2006
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in WebHostManager (WHM) 10.8.0 cPanel 10.9.0 R50 allow remote attackers to inject arbitrary web script or HTML via the (1) theme parameter to scripts/dosetmytheme and the (2) template parameter to scripts2/editzonetemplate.

  • CVE-2006-4293Aug 22, 2006
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the (2) file parameter in (a) editit.html or (b) showfile.html.

  • CVE-2006-3337Jul 3, 2006
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in frontend/x/files/select.html in cPanel 10.8.2-CURRENT 118 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter.

  • CVE-2005-2021Jun 20, 2005
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in cPanel 9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the user parameter in the login page.

  • CVE-2004-2308Dec 31, 2004
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the dir parameter in dohtaccess.html.

  • CVE-2004-0490Aug 18, 2004
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.04

    cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the PATH_TRANSLATED variable, which allows local users to…

  • CVE-2004-1875Mar 30, 2004
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to…

  • CVE-2003-0521Aug 18, 2003
    CPanel
    Cpanel
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the (1) Error Log or (2) Latest Visitors…

  • CVE-2008-2071May 12, 2008
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote attackers to perform unauthorized actions as cPanel administrators via requests to cpanel/whm/webmail and other…

  • CVE-2008-2043May 1, 2008
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in cPanel, possibly 11.18.3 and 11.19.3, allow remote attackers to (1) execute arbitrary code via the command1 parameter to frontend/x2/cron/editcronsimple.html, and perform various administrative actions via (2)…

  • CVE-2008-0370Jan 22, 2008
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in dohtaccess.html in cPanel before 11.17 build 19417 allows remote attackers to inject arbitrary web script or HTML via the rurl parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2007-3366Jun 22, 2007
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2007-3367Jun 22, 2007
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to obtain sensitive information via a direct request, which reveals the path in an error message. NOTE: the provenance of this information is unknown; the details are…

  • CVE-2007-0854Feb 8, 2007
    CPanel
    Webhost Manager
    risk 0.00cvss —epss 0.06

    Remote file inclusion vulnerability in scripts2/objcache in cPanel WebHost Manager (WHM) allows remote attackers to execute arbitrary code via a URL in the obj parameter. NOTE: a third party claims that this issue is not file inclusion because the contents are not parsed, but…

  • CVE-2006-6548Dec 14, 2006
    CPanel
    Webhost Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the domain parameter to (1) scripts2/changeemail, (2) scripts2/limitbw, or (3) scripts/rearrangeacct. NOTE: the…

  • CVE-2006-2825Jun 5, 2006
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    cPanel does not automatically synchronize the PHP open_basedir configuration directive between the main server and virtual hosts that share physical directories, which might allow a local user to bypass open_basedir restrictions and access other virtual hosts via a PHP script…

  • CVE-2006-1119Mar 9, 2006
    CPanel
    Fantastico De Luxe
    risk 0.00cvss —epss 0.01

    fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message.

  • CVE-2006-0763Feb 18, 2006
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in dowebmailforward.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via a URL encoded value in the fwd parameter.

  • CVE-2006-0574Feb 7, 2006
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in mime/handle.html in cPanel 10 allows remote attackers to inject arbitrary web script or HTML via the (1) file extension or (2) mime-type.

  • CVE-2006-0573Feb 7, 2006
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilies in cPanel 10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to (a) editquota.html or (b) dodelpop.html; (2) showtree parameter to (c) diskusage.html; or the (3) mon, (4)…

  • CVE-2006-0533Feb 4, 2006
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in webmailaging.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via the numdays parameter.

  • CVE-2005-3505Nov 5, 2005
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Entropy Chat script in cPanel 10.2.0-R82 and 10.6.0-R137 allows remote attackers to inject arbitrary web script or HTML via a chat message containing Javascript in style attributes in tags such as , which are processed by…

  • CVE-2004-1604Sep 30, 2004
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the _private directory, which is created when Front Page extensions are enabled.

  • CVE-2004-0529Aug 6, 2004
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as (1) proftpdvhosts or…

  • CVE-2004-1849Mar 24, 2004
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to dodelautores.html or (2) handle parameter to addhandle.html.

  • CVE-2003-1426Dec 31, 2003
    CPanel
    Cpanel
    risk 0.00cvss —epss 0.00

    Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to execute arbitrary code by modifying SCRIPT_FILENAME to reference a directory containing a malicious…

Page 9 of 9