1621 matches found
Code injection
cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups SEC-338...
Cross site scripting
cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface SEC-86...
Design/Logic Flaw
cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API SEC-66...
Cross site scripting
cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry SEC-370...
Design/Logic Flaw
cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface SEC-421...
Design/Logic Flaw
cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface SEC-87...
Cross site scripting
cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action SEC-376...
Command injection
cPanel before 70.0.23 allows demo accounts to execute code via awstats SEC-362...
Design/Logic Flaw
cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction SEC-429...
Cross site scripting
cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action SEC-377...
CVE-2016-10850
cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost SEC-83...
CVE-2016-10850
CVE-2016-10850 : Affects cPanel before 11.54.0.4; allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83). Impact: high (per CVSS). Root cause/details are not expanded in the provided documents beyond the described vector. Recommended remediation: upgrade to 11.54.0.4 or newe...
CVE-2018-20923
CVE-2018-20923 affects cPanel prior to version 70.0.23. The vulnerability is a stored XSS in the WHM Synchronize DNS Records action (SEC-377), enabling script execution in a victim’s browser. Public documents consistently describe it as a stored XSS in the web interface, with the NVD metrics indi...
CVE-2018-20922
cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action SEC-376...
CVE-2018-20922
CVE-2018-20922 affects cPanel prior to 70.0.23, where a stored XSS vulnerability exists via a WHM DNS Cleanup action (SEC-376). Public references across NVD/Red Hat/CNVD confirm the issue and scope, describing an XSS path arising from insufficient input validation in the web application. The comm...
CVE-2018-20921
cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action SEC-375...
CVE-2018-20921
CVE-2018-20921: cPanel before 70.0.23 allows a stored XSS via the WHM action “Delete a DNS Zone” (SEC-375). The event is triggered by unvalidated data in the DNS zone deletion workflow within WHM. The available documents consistently describe the vulnerability as stored XSS affecting cPanel/WHM p...
CVE-2018-20920
CVE-2018-20920 : cPanel before 70.0.23 is affected by a stored XSS in the WHM Edit DNS Zone action (SEC-374). Root cause stated in CNVD/Red Hat sources as insufficient validation of client-side data, enabling execution of injected scripts. Affected product: cPanel/WHM (versions prior to 70.0.23)....