Design/Logic Flaw

cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-109...

CVE-2016-10805

CVE-2016-10805 affects cPanel versions prior to 57.9999.54. The issue allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109), enabling remote code execution with the potential for full control under the public-facing web interface. According to connected sources...

CVE-2019-1125

creationtimestamp| type| source ---|---|--- 2019-08-06 20:25:49+00:00| seen| https://t.me/ctinow/14358 2019-08-06 22:24:13+00:00| seen| https://t.me/ctinow/14366 2023-11-07 15:02:36+00:00| seen| https://t.me/thehackernews/413 2026-07-29 12:01:17+00:00| seen|...

CVE-2019-14473

eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp...

CVE-2019-2386

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9;...

CVE-2016-10791

cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible CPANEL-9559...

CVE-2016-10791

cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible CPANEL-9559...

Code injection

cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible CPANEL-9559...

CVE-2016-10791

CVE-2016-10791 affects cPanel before 60.0.15. The issue arises because the product does not ensure that system accounts lack a valid password, which can render logins impossible (CPANEL-9559). Connected sources consistently describe the same flaw, with no explicit details on affected versions bey...

CVE-2016-10791

cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible CPANEL-9559...

cPanel Code Execution Vulnerability (CNVD-2019-26336)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A code execution vulnerability exists in versions of cPanel prior to 64.0.21. An attacker exploited the vulnerability to execute...

mongodb -- Attach IDs to users

Mitch Wasson of Cisco's Advanced Malware Protection Group reports: After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones...

CVE-2019-14546

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was inserted inside the Email Signature in the Preference page. The attacker could insert malicious JavaScript inside his email signature, whi...

CVE-2019-14547

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the...

Cross site scripting

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was inserted inside the Email Signature in the Preference page. The attacker could insert malicious JavaScript inside his email signature, whi...

Cross site scripting

An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Article can be formed by an attacker using the Knowledge Base feature in the tab list. The attacker could inject malicious JavaScript inside...

MyEtherWallet: Local Storage Custom Node Credentials Leak

Summary Credentials for a custom node are stored in plain text inside Local Storage on the user's machine. If this node is configured in a certain way this could lead to the theft of any funds in accounts attached to this node, by a local attacker. And if not configured this way, an attacker coul...

CVE-2017-18469

cPanel before 62.0.17 allows demo accounts to execute code via an NVDatafetchinc API call SEC-233...

CVE-2017-18469

cPanel before 62.0.17 allows demo accounts to execute code via an NVDatafetchinc API call SEC-233...

CVE-2017-18469

CVE-2017-18469 affects cPanel prior to 62.0.17, where demo accounts can execute code via an NVData_fetchinc API call (SEC-233). Affected software: cPanel versions before 62.0.17. Root cause: exploitable API call allowing code execution. Impact: potential arbitrary code execution by unauthenticate...