Command injection

cPanel before 70.0.23 allows demo accounts to execute code via awstats SEC-362...

Design/Logic Flaw

cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface SEC-421...

Cross site scripting

cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action SEC-377...

Design/Logic Flaw

cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction SEC-429...

Design/Logic Flaw

cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface SEC-87...

Cross site scripting

cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action SEC-376...

Cross site scripting

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...

CVE-2016-10850

cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost SEC-83...

CVE-2016-10850

CVE-2016-10850 : Affects cPanel before 11.54.0.4; allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83). Impact: high (per CVSS). Root cause/details are not expanded in the provided documents beyond the described vector. Recommended remediation: upgrade to 11.54.0.4 or newe...

CVE-2018-20923

CVE-2018-20923 affects cPanel prior to version 70.0.23. The vulnerability is a stored XSS in the WHM Synchronize DNS Records action (SEC-377), enabling script execution in a victim’s browser. Public documents consistently describe it as a stored XSS in the web interface, with the NVD metrics indi...

CVE-2018-20922

cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action SEC-376...

CVE-2018-20922

CVE-2018-20922 affects cPanel prior to 70.0.23, where a stored XSS vulnerability exists via a WHM DNS Cleanup action (SEC-376). Public references across NVD/Red Hat/CNVD confirm the issue and scope, describing an XSS path arising from insufficient input validation in the web application. The comm...

CVE-2018-20921

cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action SEC-375...

CVE-2018-20921

CVE-2018-20921: cPanel before 70.0.23 allows a stored XSS via the WHM action “Delete a DNS Zone” (SEC-375). The event is triggered by unvalidated data in the DNS zone deletion workflow within WHM. The available documents consistently describe the vulnerability as stored XSS affecting cPanel/WHM p...

CVE-2018-20920

CVE-2018-20920 : cPanel before 70.0.23 is affected by a stored XSS in the WHM Edit DNS Zone action (SEC-374). Root cause stated in CNVD/Red Hat sources as insufficient validation of client-side data, enabling execution of injected scripts. Affected product: cPanel/WHM (versions prior to 70.0.23)....

CVE-2018-20919

cPanel before 70.0.23 allows stored XSS via a WHM Create Account action SEC-373...

CVE-2016-10852

cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem SEC-85...

CVE-2018-20916

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...

CVE-2018-20916

CVE-2018-20916 affects cPanel prior to 70.0.23. The vulnerability is a Stored XSS in WHM via the Edit MX Entry, caused by lack of proper validation of client-side data in the web application. Impact stated as attacker-controlled scripts executed in the victim’s browser. Remediation: upgrade to 70...

CVE-2016-10853

Summary: CVE-2016-10853 affects cPanel before 11.54.0.4, with a stored XSS vulnerability in the WHM Feature Manager interface (SEC-86). Multiple connected sources (NVD/NVD mirror, Red Hat security page, CNVD) corroborate this description. What’s vulnerable: The WHM Feature Manager component of cP...