Product:

Cpanel

(Cpanel)
Repositories

Unknown:

This might be proprietary software.

#Vulnerabilities 402
Date Id Summary Products Score Patch Annotated
2008-05-28 CVE-2008-2478 scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this, stating "I'm unable to reproduce such an issue on multiple servers running different versions of cPanel. Cpanel N/A
2004-10-18 CVE-2004-1603 cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled. Cpanel 5.5
2008-05-12 CVE-2008-2071 Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote attackers to perform unauthorized actions as cPanel administrators via requests to cpanel/whm/webmail and other unspecified vectors. Cpanel N/A
2008-05-12 CVE-2008-2070 The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the (1) issue parameter to scripts2/knowlegebase, (2) user parameter to scripts2/changeip, (3) search parameter to scripts2/listaccts, and other unspecified vectors. Cpanel N/A
2021-01-26 CVE-2021-26267 cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579). Cpanel 7.5
2023-04-27 CVE-2023-29489 An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. Cpanel 6.1
2021-08-11 CVE-2021-38587 In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). Cpanel 7.5
2021-08-11 CVE-2021-38590 In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). Cpanel 5.5
2020-11-27 CVE-2020-29136 In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). Cpanel 6.5
2021-08-11 CVE-2021-38584 The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). Cpanel 7.2