5174 matches found
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
Acronis has warned that a high-severity security flaw in its Backup plugin for cPanel and Web Host Manager WHM deployments has been exploited in the wild. The vulnerability, tracked as CVE-2026-87886 CVSS score: 7.8, is described as a case of local privilege escalation due to insecure file...
PT-2026-93945
Attackers exploited CVE-2024-50873 to escalate privileges in Acronis Backup plugin for cPanel/WHM environments. TRC analysis shows lateral movement across shared hosting infrastructure after initial compromise. Runtime segmentation helps contain post-compromise activity in multi-tenant...
Acronis Backup Incorrect Default Permissions Vulnerability
Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation...
CVE-2026-56831
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixedamount discount values, persists them in shdiscounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and...
Astra Linux – Vulnerability in libcpanel-json-xs-perl
Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow that causes a segfault when parsing crafted JSON, allowing for denial-of-service attacks or other unspecified impacts...
PT-2026-93254
Name of the Vulnerable Software and Affected Versions Acronis Backup plugin for cPanel & WHM Linux versions prior to 1.9.3.1021 Acronis Backup extension for Plesk Linux versions prior to 1.8.11.638 Acronis Backup plugin for DirectAdmin Linux versions prior to 1.2.3.238 Description Local privilege...
cve-2026-41940-PoC
CVE-2026-41940 ⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited. Description A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM CVSS 10.0, allowing unauthenticat...
CVE-2026-67401
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...
CVE-2026-67401
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...
EUVD-2026-75062
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...
CVE-2026-67401
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...
CVE-2026-67401
A SQL injection vulnerability in cPanel's EmailTrack component allows a mail-enabled hosting account to achieve remote code execution as root . Affected versions include 11.110, 11.134, 11.136, 11.138 , and WP Squared 11.138.1.9 , or any build below the patched version. The CVSS score is 9.9 (Cri...
Exploit for CVE-2026-67401
CVE-2026-67401 — cPanel & WHM EmailTrack SQL Injection → Root...
New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user. cPanel published the...
CVE-2026-67401: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...
cPanel EmailTrack CVE-2026-67401 Scanner / Mitigation
This toolkit provides detection and mitigation utilities for CVE-2026-67401, a SQL injection vulnerability affecting the cPanel and WHM EmailTrack functionality. The included scanner checks the installed cPanel version and package integrity, searches system and database logs for suspicious...
PT-2026-88179
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.110.0.143 cPanel versions prior to 11.134.0.55 cPanel versions prior to 11.136.0.39 cPanel versions prior to 11.138.0.4 cPanel WP Squared versions prior to 11.138.1.9 Description A SQL injection flaw exists in the...
Exploit for Missing Authentication for Critical Function in Cpanel
CVE-2026-41940...