Design/Logic Flaw

cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem SEC-85...

Cross site scripting

cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action SEC-369...

Default credentials

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands SEC-65...

Design/Logic Flaw

cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API SEC-66...

Command injection

cPanel before 70.0.23 allows demo accounts to execute code via awstats SEC-362...

Cross site scripting

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...

Authentication flaw

cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit SEC-60...

Design/Logic Flaw

cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction SEC-429...

Cross site scripting

cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster SEC-372...

Design/Logic Flaw

cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface SEC-421...

Code injection

cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds SEC-29...

Cross site scripting

cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action SEC-377...

Cross site scripting

cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action SEC-376...

Design/Logic Flaw

cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling SEC-435...

Code injection

cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost SEC-83...

Code injection

cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd SEC-91...

Design/Logic Flaw

cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface SEC-87...

Design/Logic Flaw

cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface SEC-357...

CVE-2016-10850

cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost SEC-83...

CVE-2016-10850

CVE-2016-10850 : Affects cPanel before 11.54.0.4; allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83). Impact: high (per CVSS). Root cause/details are not expanded in the provided documents beyond the described vector. Recommended remediation: upgrade to 11.54.0.4 or newe...