cPanel fails to verify input passed to the "user" parameter

Overview A remotely exploitable vulnerability in CPanel's password reset and login scripts may allow a remote attacker to gain control of the vulnerable system. Description Cpanel is an application that provides the ability to manage accounts and provides an interface to the end users of web...

Cpanel 9.1.0 have a problem ?

Hi all I found another problem in login script http://www.xxx.com:2082/login/?user=|"id"| it same the first it give ROOT & u can use "+" or "20" without any problem : ! lool look @ this: / sh: /var/cpanel/users/: is a directory sh: uid=0root gid=0root...

cPanel 56789 - dir Cross-Site Scripting

cPanel 56789 - dir Cross-Site Scripting source: https://www.securityfocus.com/bid/9853/info It has been reported that cPanel may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. The issue presents itself due to...

cPanel 56789 - Login Script Remote Command Execution

cPanel 56789 - Login Script Remote Command Execution source: https://www.securityfocus.com/bid/9855/info A potential remote command execution vulnerability has been discovered in the cPanel application. This issue occurs due to insufficient sanitization of externally supplied data to the login...

cPanel 5/6/7/8/9 - Login Script Remote Command Execution

source: https://www.securityfocus.com/bid/9855/info A potential remote command execution vulnerability has been discovered in the cPanel application. This issue occurs due to insufficient sanitization of externally supplied data to the login script. An attacker may exploit this problem by craftin...

CVE-2004-1769

The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass...

cPanel 56789 - Resetpass Remote Command Execution

cPanel 56789 - Resetpass Remote Command Execution source: https://www.securityfocus.com/bid/9848/info A potential remote command execution vulnerability has been discovered in the cPanel Application. This issue occurs due to insufficient sanitization of externally supplied data to the script that...

CVE-2003-0521

Cross-site scripting XSS vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the 1 Error Log or 2 Latest Visitors screens...

CVE-2003-0521

Cross-site scripting XSS vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the 1 Error Log or 2 Latest Visitors screens...

cPanel Malicious HTML Tags Injection Vulnerability

------------------------------------------------------------------------------- ----- cPanel Malicious HTML Tags Injection Vulnerability ------------------------------------------------------------------------------- -- Author: Ory Segal, Sanctum inc. http://www.SanctumInc.com -- Discovery Date:...

CPanel 5.05.36.x - Admin Interface HTML Injection

CPanel 5.05.36.x - Admin Interface HTML Injection source: https://www.securityfocus.com/bid/8119/info cPanel is prone to an HTML injection vulnerability. It is possible for remote attacks to include hostile HTML and script code in requests to cPanel, which will be logged. When logs are viewed by ...

CPanel 5.0/5.3/6.x - Admin Interface HTML Injection

source: https://www.securityfocus.com/bid/8119/info cPanel is prone to an HTML injection vulnerability. It is possible for remote attacks to include hostile HTML and script code in requests to cPanel, which will be logged. When logs are viewed by an administrative user, the injected code could be...

cPanel 5/6 / Formail-Clone - E-Mail Restriction Bypass

source: https://www.securityfocus.com/bid/7758/info It has been reported that cPanel is prone to an issue where a remote attacker may bypass cPanel Formail-clone local domain checks and have untrusted e-mail delivered in the context of the vulnerable host. This issue may be exploited by an attack...

cPanel 5.0 - Guestbook.cgi Remote Command Execution (2)

cPanel 5.0 - Guestbook.cgi Remote Command Execution 2 source: https://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cg...

cPanel 5.0 - Guestbook.cgi Remote Command Execution (3)

cPanel 5.0 - Guestbook.cgi Remote Command Execution 3 source: https://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cg...

cPanel 5.0 - 'Guestbook.cgi' Remote Command Execution (3)

source: https://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script. An attacker may exploit this vulnerability ...

cPanel 5.0 - 'Guestbook.cgi' Remote Command Execution (1)

// source: https://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script. An attacker may exploit this vulnerabili...

cPanel 5.0 - Guestbook.cgi Remote Command Execution (1)

cPanel 5.0 - Guestbook.cgi Remote Command Execution 1 // source: https://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the...

cPanel 5.0 - Guestbook.cgi Remote Command Execution (4)

cPanel 5.0 - Guestbook.cgi Remote Command Execution 4 source: https://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cg...

cPanel 5.0 - 'Guestbook.cgi' Remote Command Execution (2)

source: https://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script. An attacker may exploit this vulnerability ...