Code injection

cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...

CVE-2018-20870

The WebDAV transport feature in cPanel before 76.0.8 enables debug logging SEC-467...

CVE-2018-20870

CVE-2018-20870 affects the WebDAV transport feature in cPanel versions before 76.0.8 . The vulnerability is that debug logging is enabled by this feature (SEC-467). The connected documents consistently echo this description but do not provide explicit exploit details, impacted products beyond the...

CVE-2018-20869

CVE-2018-20869 affects cPanel before 76.0.8, where arbitrary code execution is possible in the root context via dnssec adminbin (SEC-465). Multiple sources (NVD/Red Hat/CNVD/CVE lists) confirm the flaw allowing local escalation with high impact (C/H/I/A). Affected product is cPanel; vulnerable co...

CVE-2018-20869

cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin SEC-465...

CVE-2018-20862

The CVE-2018-20862 issue affects cPanel prior to 76.0.8, where PostgreSQL password changes are performed unsafely (SEC-366). Affected: cPanel’s password-change workflow for PostgreSQL. Impact: potential improper handling of password changes; CVSS indicates high impact (confidentiality, integrity,...

CVE-2018-20862

cPanel before 76.0.8 unsafely performs PostgreSQL password changes SEC-366...

CVE-2018-20868

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface SEC-464...

CVE-2018-20868

cPanel before 76.0.8 contains a Stored XSS in the WHM MultiPHP Manager interface (SEC-464). Affected product: cPanel/WHM (MultiPHP Manager); vulnerable component: stored XSS in the interface. Root cause: vulnerability described as Stored XSS; the exact exploit details are not provided in the docu...

CVE-2018-20866

CVE-2018-20866 affects cPanel before 76.0.8, with a Stored XSS in the WHM “Reset a DNS Zone” feature (SEC-461). The vulnerability concerns the handling of input in Reset DNS Zone, enabling stored cross-site scripting. Documents consistently describe the issue as a stored XSS vulnerability in that...

CVE-2018-20866

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature SEC-461...

CVE-2018-20865

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field SEC-459...

CVE-2018-20865

CVE-2018-20865 affects cPanel prior to 76.0.8, where a Self XSS flaw exists in the WHM Addtional Backup Destination field (SEC-459). Exploitation context is not detailed in the provided documents, but the vulnerability is tied to user-supplied content in the WHM backup destination setting, enabli...

CVE-2018-20864

CVE-2018-20864 affects cPanel before 76.0.8. The vulnerability allows a persistent Virtual FTP account after removal of its associated domain (SEC-454). Public details in connected sources describe the affected product and the outcome, but do not provide explicit root-cause analysis or remediatio...

CVE-2018-20864

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain SEC-454...

CVE-2018-20863

CVE-2018-20863 affects cPanel prior to 76.0.8, where remote attackers can achieve arbitrary code execution via mailing-list attachments (SEC-452). The CVE entry is corroborated across multiple sources (NVD, Red Hat, CNVD, CVE List). Patches exist (76.0.8+), but exploitation details are not elabor...

CVE-2018-20863

cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments SEC-452...

CVE-2019-14414

CVE-2019-14414 affects cPanel before 78.0.2, where a Userdata cache temporary file can conflict with domains (SEC-478). The vulnerability concerns the Userdata cache handling and is documented with a Low severity (CVSSv2/3: low, local access, partial integrity impact). Exploitation details are no...

CVE-2019-14414

In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains SEC-478...

CVE-2019-14413

CVE-2019-14413 affects cPanel prior to 78.0.2, where an input validation/permissions issue allows certain file-write operations as a shared user during connection resets (SEC-476). Documented by multiple sources (NVD, Red Hat, CNVD, CVE lists) confirms the vulnerability in the cPanel web-based pl...