GHSA-JVX4-XV3M-HRJ4 Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()

Summary In Domains.add, the adminid parameter is accepted from user input and used without validation when the calling reseller does not have the customersseeall permission. This allows a reseller to attribute newly created domains to any other admin, bypassing their own domain quota since the...

CVE-2026-27602

Modoboa contains an OS command injection vulnerability (CWE-like) due to exec_cmd paths using subprocess with shell=True and unsanitized domain/input values. In modoboa/lib/sysutils.py and related sinks (DKIM domain handling, mailbox rename, sa-learn, doveadm, rrdtool, webmail operations), domain...

GHSA-WWV8-CQPR-VX3M Modoboa has OS Command Injection

Summary execcmd in modoboa/lib/sysutils.py always runs subprocess calls with shell=True. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server...

CVE-2017-18482

cPanel before 62.0.4 allows resellers to use the WHM enqueuetransferitem API for queueing non-rearrange modules SEC-213...

CVE-2017-18426

cPanel before 66.0.2 allows resellers to read other accounts' domain log files SEC-288...

CVE-2021-26266

cPanel before 92.0.9 allows a Reseller to bypass the suspension lock SEC-578...

CVE-2021-26266

cPanel before 92.0.9 allows a Reseller to bypass the suspension lock SEC-578...

CVE-2017-18426

cPanel before 66.0.2 allows resellers to read other accounts' domain log files SEC-288...

CVE-2017-18426

cPanel before 66.0.2 allows resellers to read other accounts' domain log files SEC-288...