Where
-Infinity
0

Trending

Last week
Last month
Last year

Cpanel CpanelHTTP Smuggling in cPanel allows potential leak of credentials.

Risk 60
Severity
5.6
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

HTTP Smuggling in cPanel allows potential leak of credentials.

First published (updated )
CVE-2026-58047

Cpanel CpanelSSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to m…

Risk 54
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

First published (updated )
CVE-2026-32992

Cpanel CpanelIncorrect privileges management and insufficient path filtering allow to read arbitrary file on the …

Risk 67
Severity
8.6
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

First published (updated )
CVE-2026-29205

Cpanel cPanel & WHMWebPros cPanel and WHM Authentication Bypass via Login Flow

Risk 99
Severity
9.3
Exploited
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-41940

Cpanel CpanelPath Traversal

Risk 79
Severity
8.8
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.

First published (updated )
CVE-2025-66429

Cpanel CpanelXEE

Risk 66
Severity
7.2
XEE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).

First published (updated )
CVE-2021-38584

Cpanel CpanelThe WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).

Risk 66
Severity
7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).

First published (updated )
CVE-2021-38585

Cpanel CpanelIn cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).

Risk 26
Severity
4.4
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

In cPanel before 98.0.1, /scripts/cpanconfig performs unsafe operations on files (SEC-589).

First published (updated )
CVE-2021-38586

Cpanel CpanelRace Condition

Risk 43
Severity
7.5
Race Condition
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).

First published (updated )
CVE-2021-38587

Cpanel CpanelIn cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587)…

Risk 75
Severity
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

In cPanel before 96.0.13, fixcpanelperl lacks verification of the integrity of downloads (SEC-587).

First published (updated )
CVE-2021-38588

Cpanel CpanelIn cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of file…

Risk 60
Severity
8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).

First published (updated )
CVE-2021-38589

Cpanel CpanelIn cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).

Risk 32
Severity
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).

First published (updated )
CVE-2021-38590

Cpanel CpanelInput Validation

Risk 78
Severity
9
Input Validation
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).

First published (updated )
CVE-2016-10812

Cpanel CpanelInfoleak

Risk 78
Severity
9
Infoleak
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).

First published (updated )
CVE-2016-10811

Cpanel CpanelInfoleak

Risk 78
Severity
9
Infoleak
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In cPanel before 57.9999.54, /scripts/maildirconverter exposed a TTY to an unprivileged process (SEC-115).

First published (updated )
CVE-2016-10810

Cpanel CpanelInfoleak

Risk 78
Severity
9
Infoleak
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).

First published (updated )
CVE-2016-10809

Cpanel CpanelInput Validation

Risk 78
Severity
9
Input Validation
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).

First published (updated )
CVE-2016-10808

Cpanel CpanelInput Validation

Risk 38
Severity
6.5
Input Validation
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).

First published (updated )
CVE-2016-10807

Cpanel CpanelXSS

Risk 34
Severity
5.4
XSS
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).

First published (updated )
CVE-2016-10806

Cpanel CpanelInput Validation

Risk 79
Severity
8.8
Input Validation
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl (SEC-109).

First published (updated )
CVE-2016-10805

Cpanel CpanelInput Validation, SQL Injection

Risk 69
Severity
8.7
Input Validation, SQL Injection
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).

First published (updated )
CVE-2016-10804

Cpanel CpanelCRLF Injection

Risk 43
Severity
7.5
CRLF Injection
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).

First published (updated )
CVE-2016-10803

Cpanel CpanelcPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI…

Risk 79
Severity
8.8
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).

First published (updated )
CVE-2016-10802

Cpanel CpanelcPanel before 58.0.4 has improper session handling for shared users (SEC-139).

Risk 79
Severity
8.8
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

cPanel before 58.0.4 has improper session handling for shared users (SEC-139).

First published (updated )
CVE-2016-10801

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203