5174 matches found
CVE-2026-87900
An argument injection vulnerability exists in the WP Toolkit for cPanel version 6.11.2-10794 and earlier. This flaw allows a remote authenticated user to perform database modifications in other accounts, which can include reading arbitrary files and executing arbitrary code across customer accoun...
EUVD-2026-85622
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges...
CVE-2026-87899
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges...
CVE-2026-87899
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges...
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control
A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take "full control of the server," the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change...
CVE-2026-87900: Improper Neutralization of Argument Delimiters in a Command
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts...
CVE-2026-87899: Execution with Unnecessary Privileges
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges...
PT-2026-97335
🚨🚨🚨 『Successful exploitation can lead to an authenticated cPanel user being able to perform database modifications in other accounts.』 Security: CVE-2026-87900 Vulnerability in WP Toolkit Database Creation - September 22, 2026 – cPanel https://t.co/xNBroc138B...
PT-2026-97063
Name of the Vulnerable Software and Affected Versions cPanel/WHM versions 120 through 11.133.x cPanel/WHM versions 11.134.0 through 11.134.0.56 cPanel/WHM versions 11.136.0 through 11.136.0.40 cPanel/WHM versions 11.138.0 through 11.138.0.7 WP2 versions prior to 11.138.1.11 Description Remote...
Exploit for Missing Authentication for Critical Function in Cpanel
CVE-2026-41940 ⚠ This tool is created solely for education...
CVE-2026-87886
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM Linux before build 1.9.3.1021, Acronis Backup extension for Plesk Linux before build 1.8.11.638, Acronis Backup plugin for DirectAdmin Linux before build...
CVE-2026-87886
CVE-2026-87886 is a local privilege escalation vulnerability caused by insecure default file permissions in three Acronis Backup Linux integrations: the cPanel & WHM plugin (before build 1.9.3.1021), the Plesk extension (before build 1.8.11.638), and the DirectAdmin plugin (before build 1.2.4.238...
Local privilege escalation due to insecure file permissions
Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments...
Exploit for CVE-2026-67401
CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection → Root RC...
EmailTrack Component Code Execution
The vulnerability of the EmailTrack component in the cPanel web hosting control panel is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain full control over the server...
Acronis Backup RCE
The vulnerability of the backup and data restoration plugins on Acronis Backup software for computers and servers is related to improperly used standard permissions. Exploiting this vulnerability allows a malicious actor to increase their privileges and execute arbitrary code remotely...
CVE-2026-87886: Incorrect Default Permissions
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM Linux before build 1.9.3.1021, Acronis Backup extension for Plesk Linux before build 1.8.11.638, Acronis Backup plugin for DirectAdmin Linux before build...
CVE-2026-87886: Incorrect Default Permissions
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM Linux before build 1.9.3.1021, Acronis Backup extension for Plesk Linux before build 1.8.11.638, Acronis Backup plugin for DirectAdmin Linux before build...
cve-2026-41940-PoC
CVE-2026-41940 ⚠ Esta herramienta ha sido creada únicamente con fines educativos o de bug bounty. Queda estrictamente prohibido su uso no autorizado fuera de entornos controlados. Descripción Una herramienta para explotar CVE-2026-41940, un bypass de autenticación crítico en cPanel & WHM CVSS 10....