EUVD-2026-94799

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server...

CVE-2026-93699: Improper Neutralization of Argument Delimiters in a Command

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server...

PT-2026-107868

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server...

Exploit for CVE-2026-67401

CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection → Root RC...

LiteSpeed cPanel Plugin CVE-2026-48172 Detection

Detects LiteSpeed Web Server cPanel plugin endpoints that may be vulnerable to CVE-2026-48172 Redis enable/disable privesc to root. !/usr/bin/env python3 -- coding: utf-8 -- """Detect LiteSpeed cPanel plugin privesc surface CVE-2026-48172.""" from kittysploit import from...

LiteSpeed cPanel Plugin Privesc RCE (CVE-2026-48172)

Exploits CVE-2026-48172 in the LiteSpeed cPanel plugin: mishandled Redis enable/disable API allows privilege escalation and arbitrary command execution as root via crafted cpaneljsonapi requests. !/usr/bin/env python3 -- coding: utf-8 -- """LiteSpeed cPanel plugin privesc to RCE CVE-2026-48172.""...

cve-2026-41940-PoC

CVE-2026-41940 ⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited. Description A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM CVSS 10.0, allowing unauthenticat...

Acronis Backup CVE-2026-87886 Detect

Detects Acronis Backup integrations on cPanel/WHM, Plesk, or DirectAdmin that may be affected by CVE-2026-87886 insecure file permissions enabling local privilege escalation. Fingerprints the plugin surface and parses build numbers against fixed releases cPanel 1.9.3.1021, Plesk 1.8.11.638,...

cPanelScanner

🔍 cPanel スキャナー Go で書かれた、高速でマルチスレッドの cPanel 検出ツールです。IP アドレス、CIDR レンジ、またはファイルから読み込んだターゲットリストをスキャンし、ポート 2082、2083、2087 で動作している cPanel サービスを特定します。 ✨ 機能 マルチスレッドスキャン — 同時実行数を設定可能 CIDR 対応 — サブネット全体をスキャン ファイル入力 — ファイルからターゲットを1行につき1つ読み込む 出力保存 — 検出した URL をファイルに保存 cPanel 検出 — ヘッダー、タイトル、コンテンツ、一般的なパスを確認 プログレス...

CVE-2026-84069 WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

CVE-2026-84069 WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

CVE-2026-84069

The WebFacing Email Accounts for cPanel WordPress plugin (versions 5.3-5.3.6 ) is vulnerable to Local File Inclusion (LFI) . The root cause is a failure to restrict access to a bundled script and a lack of validation for a user-supplied path used to include a local file. This allows unauthenticat...

WordPress WebFacing Email Accounts for cPanel plugin 5.3-5.3.6 - Unauthenticated LFI vulnerability

Unauthenticated LFI vulnerability discovered by nobody in WordPress Plugin WebFacing Email Accounts for cPanel versions 5.3-5.3.6...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 ⚠ This tool is created solely for education...

CVE-2026-87900

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts...

CVE-2026-87899

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-87899

A critical flaw in the CalDAV and CardDAV services of cPanel & WHM version 120 and later allows an authenticated account holder to execute arbitrary code with root privileges , potentially leading to full server control. This vulnerability is triggered by the execution of commands with unnecessar...

EUVD-2026-85619

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts...

CVE-2026-87900

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts...

CVE-2026-87900

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts...