Design/Logic Flaw

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution SEC-485...

Code injection

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution SEC-488...

Design/Logic Flaw

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces SEC-569...

Code injection

In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM SEC-552...

Design/Logic Flaw

The email quota cache in cPanel before 90.0.10 allows overwriting of files...

Default credentials

In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM SEC-549...

Design/Logic Flaw

In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM SEC-554...

CVE-2020-26098

CVE-2020-26098 affects cPanel prior to 88.0.3, where improper handling of the Exim filter path enables remote code execution (SEC-485). The issue is confirmed across multiple connected sources (RH CVE, CNVD, NVD, CVE listing, EUVD, PRION) and is characterized by a high/critical impact vector with...

EUVD-2020-18728

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution SEC-485...

CVE-2020-26098

cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution SEC-485...

CVE-2020-26099

cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism SEC-491...

CVE-2020-26099

CVE-2020-26099 affects cPanel prior to 88.0.3, where the SMTP greylisting protection (SEC-491) can be bypassed. Root cause details are not broken out beyond the vendor-reported bypass of the greylisting mechanism. The vulnerability enables an attacker to bypass SMTP greylisting, as described in t...

CVE-2020-26100

chsh in cPanel before 88.0.3 allows a Jailshell escape SEC-497...

CVE-2020-26100

CVE-2020-26100 affects cPanel prior to 88.0.3, where the chsh component enables a Jailshell escape (SEC-497). The description across sources confirms the issue and version boundary, but detailed exploit steps or exploitability are not provided in the supplied documents. A patch is indicated by up...

CVE-2020-26101

The CVE-2020-26101 affects cPanel prior to 88.0.3, where insecure RNDC credentials are used for BIND on a templated VM (SEC-549). The issue is documented across multiple sources (NVD entry for CVE-2020-26101 and related CNVD/CVE records). Affected software: cPanel

CVE-2020-26101

In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM SEC-549...

CVE-2020-26102

In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM SEC-550...

CVE-2020-26102

CVE-2020-26102 affects cPanel before 88.0.3 where Dovecot on a templated VM uses an insecure auth policy API key (SEC-550). The vulnerability is evidenced by public records showing a policy-key weakness in the Dovecot integration within cPanel’s VM templating. Public CVSS metrics indicate medium ...

CVE-2020-26103

In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM SEC-551...

CVE-2020-26103

CVE-2020-26103 affects cPanel prior to 88.0.3, where an insecure site password is used for Mailman on a templated VM. Root cause is insecure credential handling for Mailman. Impact is limited to exposure/ misuse of the Mailman credential as described in the vulnerability, with no additional explo...