Cross site scripting

cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action SEC-377...

Cross site scripting

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...

Cross site scripting

cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster SEC-372...

Design/Logic Flaw

cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling SEC-435...

Design/Logic Flaw

cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction SEC-429...

Command injection

cPanel before 70.0.23 allows demo accounts to execute code via awstats SEC-362...

Code injection

cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd SEC-91...

Design/Logic Flaw

cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface SEC-357...

CVE-2016-10850

cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost SEC-83...

CVE-2016-10850

CVE-2016-10850 : Affects cPanel before 11.54.0.4; allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83). Impact: high (per CVSS). Root cause/details are not expanded in the provided documents beyond the described vector. Recommended remediation: upgrade to 11.54.0.4 or newe...

CVE-2018-20923

CVE-2018-20923 affects cPanel prior to version 70.0.23. The vulnerability is a stored XSS in the WHM Synchronize DNS Records action (SEC-377), enabling script execution in a victim’s browser. Public documents consistently describe it as a stored XSS in the web interface, with the NVD metrics indi...

CVE-2018-20923

cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action SEC-377...

CVE-2018-20922

cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action SEC-376...

CVE-2018-20922

CVE-2018-20922 affects cPanel prior to 70.0.23, where a stored XSS vulnerability exists via a WHM DNS Cleanup action (SEC-376). Public references across NVD/Red Hat/CNVD confirm the issue and scope, describing an XSS path arising from insufficient input validation in the web application. The comm...

CVE-2018-20921

cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action SEC-375...

CVE-2018-20921

CVE-2018-20921: cPanel before 70.0.23 allows a stored XSS via the WHM action “Delete a DNS Zone” (SEC-375). The event is triggered by unvalidated data in the DNS zone deletion workflow within WHM. The available documents consistently describe the vulnerability as stored XSS affecting cPanel/WHM p...

CVE-2018-20920

cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action SEC-374...

CVE-2018-20920

CVE-2018-20920 : cPanel before 70.0.23 is affected by a stored XSS in the WHM Edit DNS Zone action (SEC-374). Root cause stated in CNVD/Red Hat sources as insufficient validation of client-side data, enabling execution of injected scripts. Affected product: cPanel/WHM (versions prior to 70.0.23)....

CVE-2018-20919

cPanel before 70.0.23 allows stored XSS via a WHM Create Account action SEC-373...

CVE-2018-20919

cPanel before 70.0.23 is affected by a stored XSS in the WHM Create Account action (SEC-373). Root cause reported as insufficient validation of client-side data in the web application; exploitation could lead to execution of client-side code. Remediation: upgrade to 70.0.23 or later (per CVE cont...