Code injection

cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls SEC-324...

CVE-2016-10822

cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images SEC-88...

CVE-2016-10822

The CVE affects cPanel before 55.9999.141, where an apparent self-XSS flaw exists in X3 Reseller Branding Images due to insufficient validation of client-supplied data. Impact is client‑side code execution as described; no exploitation details are provided in the sources. Remediation: upgrade to ...

CVE-2016-10823

cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation SEC-89...

CVE-2016-10823

The vulnerability CVE-2016-10823 affects cPanel before 55.9999.141. The root cause is MakeText interpolation, enabling arbitrary code execution in the context of the root account. Documented in multiple sources (NVD, RH, PRION, CVE lists) with the same impact description. No explicit exploit deta...

CVE-2016-10824

cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning SEC-90...

CVE-2016-10824

CVE-2016-10824 affects cPanel prior to 55.9999.141. The vulnerability enables unauthenticated arbitrary code execution via DNS NS entry poisoning. Public details in the provided connected sources are limited to the affected version and impact; no root-cause specifics or remediation steps are desc...

CVE-2016-10825

cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92). Affected product: cPanel; vulnerable version range is prior to 55.9999.141. No exploitation details or remediation steps are provided in the connected documents; monitoring for updates is a...

CVE-2016-10825

cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents SEC-92...

CVE-2016-10827

CVE-2016-10827 : A stored XSS vulnerability in cPanel/WHM (Edit System Mail Preferences) affects versions before 55.9999.141. The issue is described as a self-stored cross-site scripting flaw that could be exploited through the affected mail preferences UI. Public references in the connected docu...

CVE-2016-10827

cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences SEC-96...

CVE-2016-10828

CVE-2016-10828 affects cPanel prior to 55.9999.141. The issue is an unsafe @INC path that enables arbitrary code execution (root cause: unsafe library path resolution). Impact is high: attacker could execute code with low privileges over the network. References across sources confirm the same des...

CVE-2016-10828

cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path SEC-97...

CVE-2016-10829

The vulnerability CVE-2016-10829 affects cPanel before 55.9999.141. A multipart form processing error (SEC-99) allows arbitrary file-read operations via the affected web interface. Root cause: improper handling of multipart form data enabling unauthorized file reads. Impact: confidentiality of fi...

CVE-2016-10829

cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error SEC-99...

CVE-2016-10830

CVE-2016-10830 affects cPanel prior to 55.9999.141. The vulnerability is an ACL bypass in AppConfig applications caused by misuse of magic_revision (SEC-100). This could allow an attacker to bypass access controls, exposing otherwise restricted AppConfig functionality. Exploitation details are no...

CVE-2016-10830

cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magicrevision SEC-100...

CVE-2016-10831

CVE-2016-10831 affects cPanel before 55.9999.141. The issue is an authentication flaw where possessing another account does not trigger a two-factor authentication check (SEC-101). The vulnerability is described across multiple sources as an authorization/authentication issue in these versions. I...

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account SEC-101...

CVE-2018-20953

CVE-2018-20953 affects cPanel before 68.0.27, enabling self-XSS in the WHM listips interface due to insufficient input validation. Impact is client-side code execution in the victim’s browser when interacting with the interface. The vulnerability is documented across multiple sources (NVD/Red Hat...