CVE-2020-26113

CVE-2020-26113 affects cPanel before 90.0.10, with a self XSS vulnerability in the WHM Manage API Tokens interfaces (SEC-569). The weakness allows execution of client‑side code via token management UI, enabling a logged‑in attacker to potentially compromise session integrity. Public references co...

CVE-2020-26113

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces SEC-569...

CVE-2020-26114

cPanel before 90.0.10 allows self XSS via the Cron Jobs interface SEC-573...

CVE-2020-26114

CVE-2020-26114 (cPanel before 90.0.10) is documented as a self XSS vulnerability in the Cron Jobs interface (SEC-573). The vulnerability affects cPanel’s web-based admin UI, enabling self-derived XSS via cron job input handling. Multiple connected sources consistently describe the same issue; no ...

CVE-2020-26115

CVE-2020-26115 affects cPanel prior to 90.0.10. The issue is a self XSS via the Cron Editor interface (SEC-574). Affected product: cPanel web-based platform; vulnerability originates from improper handling in the Cron Editor, enabling a user-supplied payload to execute in the context of the admin...

CVE-2020-26115

cPanel before 90.0.10 allows self XSS via the Cron Editor interface SEC-574...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44596)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxmigrationcpanel.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from a failure to properly validate user-supplied strings before executing system...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44599)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxmigrationcpanel.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from a failure to properly validate user-supplied strings before executing system...

CVE-2020-15426

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmigrationcpanel.php. When parsing the serverip parameter, the...

CVE-2020-15432

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmigrationcpanel.php. When parsing the filespace parameter, the...

Carina - Webshell, Virtual Private Server (VPS) And cPanel Database

Carina is a web application used to store webshell, Virtual Private Server VPS and cPanel data. Carina is made so that we don't need to store webshell, VPS or cPanel data in "strange places". Screenshots Install Carina 1. $ git clone https://github.com/c0delatte/carina && cd carina 2. Run compose...

Unspecified vulnerability in cPanel (CNVD-2020-29628)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An unspecified vulnerability exists in cPanel. An attacker can exploit this vulnerability to gain access to the current working...

cPanel Input Validation Error Vulnerability (CNVD-2020-29627)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An input validation error vulnerability exists in cPanel. An attacker could exploit this vulnerability to cause a denial of servi...

CVE-2020-12785

cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature SEC-540...

CVE-2020-12784

cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings SEC-505...

CVE-2020-12785

cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature SEC-540...

CVE-2020-12784

cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings SEC-505...

Design/Logic Flaw

cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings SEC-505...

Information disclosure

cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature SEC-540...

CVE-2020-12785

CVE-2020-12785 affects cPanel prior to 86.0.14. The vulnerability allows an attacker to obtain access to the current working directory via the account backup feature, constituting an information-disclosure issue. The available sources consistently describe the affected product and the vulnerable ...