30 matches found
cPanel-WHM-CVE-2026-41940-auth-bypass-exploit
CVE-2026-41940 - cPanel & WHM Authentifizierungs-Bypass-Exploit Kritischer Authentifizierungs-Bypass durch CRLF-Injection im cPanel/WHM-cpsrvd-Daemon 📋 Übersicht Bei CVE-2026-41940 handelt es sich um eine kritische Authentifizierungs-Bypass-Schwachstelle in cPanel & WHM, die nicht authentifiziert...
CVE-2026-41940-analysis
CVE-2026-41940 — cPanel & WHM Bypass de Root Pré-Autenticação via Injeção CRLF em Arquivo de Sessão Um Mergulho Técnico Profundo Focado em Defensores 1. Resumo Executivo Campo| Valor ---|--- ID CVE| CVE-2026-41940 CVSS v3.1| 9.8 Crítico — Rede / Baixa Complexidade / Sem Privilégios / Sem Interaçã...
CVE-2023-29489
Einleitung Eine ausnutzbare reflektierte Cross-Site-Scripting XSS-Sicherheitslücke wurde in bestimmten Versionen von cPanel entdeckt und mit der CVE-2023-29489 gekennzeichnet. Diese Sicherheitslücke ermöglicht es Angreifern, beliebigen JavaScript-Code ohne Authentifizierung auszuführen. Die...
poc-cpanel-cve-2026-41940
POC cPanel CVE-2026-41940 Uno strumento di audit di sicurezza ad alte prestazioni e multi-thread progettato per rilevare CVE-2026-41940 , una vulnerabilità critica di Authentication Bypass in cPanel & WHM scoperta ad aprile 2026. Questo strumento sfrutta una tecnica di CRLF Injection negli header...
tool-29489
Tool-29489 Panoramica 🔍: Questo strumento viene utilizzato per identificare URL con la vulnerabilità CVE-2023-29489. Lo strumento utilizza payload per identificare il bug. Menu di aiuto di tool-29489: python main.py help URL inputfile outputfile -h o --help : Per visualizzare le opzioni di aiuto...
CPANEL-CVE-2026-41940
CVE-2026-41940 — cPanel/WHM Bypass dell'Autenticazione Autore: SilySec Ricerca originale: Sina Kheirkhah @SinSinology / watchTowr Labs Gravità: Critica CVSS 9.8 Tipo: Iniezione CRLF → Bypass dell'autenticazione → Shell root Descrizione CVE-2026-41940 è una vulnerabilità critica in cPanel/WHM che...
CVE-2026-41940
CVE-2026-41940 — cPanel/WHM 认证绕过 作者: Dr.Anach | 联系方式: @dranach | 许可证: MIT 概述 cpsrvd Basic 认证处理器中的 CRLF 注入 → 未认证的 WHM API 访问 → 以 root 身份远程执行代码。影响所有自 v11.40 以来的 cPanel 版本。 攻击链 | 步骤| 请求 ---|---|--- 1| 创建会话| GET /login/?user=root 2| CRLF 注入| Authorization: Basic — 密码携带 \r\n 载荷 3| 缓存提升| GET...
cpanel-xss-177
xss - cpanelCVE-2023-29489 cPanel in den Versionen 11.102.0.x 11.102.0.31 / 11.106.0.x 11.106.0.x / 11.108.0.x 11.108.0.13 / 11.109.9999.x 11.109.9999.116 ist anfällig für Reflected Cross-Site Scripting über speziell gestaltete Anfragen an die Web-Call-ID, wenn diese auf der Fehlerseite für cpsrv...
CVE-2026-41940_exploit
CVE-2026-41940 - Exploit di Bypass dell'Autenticazione di cPanel e WHM Vulnerabilità: Manipolazione del file di sessione tramite iniezione CRLF nel gestore di autenticazione HTTP Basic di cpsrvd CVE: CVE-2026-41940 CVSS: 9.8 Critico CWE: CWE-93 Iniezione CRLF / CWE-306 Autenticazione Mancante...
cPanel - CRLF Injection
ExploitTitle: cPanel 11.40 - CRLF Injection Author: nu11secur1tyAI Date: 2026-04-30 Vendor: cPanel, L.L.C. Software: cPanel & WHM cpsrvd Reference: CVE-2026-41940 / watchTowr-2026-01 Description: A critical authentication bypass vulnerability exists in the cPanel/WHM cpsrvd daemon due to improper...
📄 CPanel/WHM CRLF Injection / Authentication Bypass / Remote Code Execution
This Metasploit module exploits CVE-2026-41940, a CRLF injection in cPanel/WHMs cpsrvd daemon that allows unauthenticated remote code execution as root. The Basic-auth handler writes the password to the raw session file without stripping newlines. Omitting the ob-part of the session cookie bypass...
Exploit for Missing Authentication for Critical Function in Cpanel
================================================================...
cPanel/WHM CRLF Injection Authentication Bypass RCE
Exploits CVE-2026-41940, a CRLF injection in cPanel/WHM's cpsrvd daemon that allows unauthenticated remote code execution as root. The Basic-auth handler writes the password to the raw session file without stripping newlines. Omitting the ob-part of the session cookie bypasses the encoder, so...
CVE-2016-10789
cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler SEC-191...
EUVD-2016-1783
Malware in sbrugna...
CVE-2023-29489
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31...
CVE-2023-29489
CVE-2023-29489 affects cPanel before 11.109.9999.116, with XSS on the cpsrvd error page triggered by an invalid webcall ID (SEC-669). Impact is browser-execution of malicious scripts, as described, with the vulnerability graded as MEDIUM (CVSS v3.1). Affected fixed versions are 11.109.9999.116, 1...
PT-2023-2904
Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 11.109.9999.116 cPanel versions prior to 11.108.0.13 cPanel versions prior to 11.106.0.18 cPanel versions prior to 11.102.0.31 Description: A reflected Cross-Site Scripting XSS vulnerability was discovered in cPanel...
cPanel Remote Code Execution Vulnerability (CNVD-2020-18555)
cPanel is a set of Web-based host control management system of the U.S. cPanel. A remote code execution vulnerability exists in cPanel versions prior to 84.0.20. The vulnerability can be exploited to achieve remote code execution via the cpsrvd rsync shell using a demo account...