PT-2026-40440

Name of the Vulnerable Software and Affected Versions cPanel & WHM affected versions not specified Description Improper sanitization of the status query parameter in the '/unprotected/nova error' endpoint allows an unauthenticated attacker to inject arbitrary HTTP headers into the response...

PT-2026-38674

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.136.0.9 cPanel versions prior to 11.136.1.10 WP Squared cPanel versions prior to 11.134.0.25 cPanel versions prior to 11.132.0.31 cPanel versions prior to 11.130.0.22 cPanel versions prior to 11.126.0.58 cPanel...

cPanel WebHost Manager WordPress Squared authentication bypass code execution

The vulnerability in web hosting via cPanel, WebHost Manager, and WordPress Squared hosting panel is related to the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and execute arbitrary code...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940-POC cPanel/WHM Authentication Bypass Proof of...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 - cPanel & WHM Authentication Bypass Proof of C...

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

WebPros cPanel & WHM WebHost Manager and WP2 WordPress Squared contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel...

PT-2026-35936

Name of the Vulnerable Software and Affected Versions cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 WP Squared versions prior to 136.1.7 Description An authentication bypass exists in the login flow of the cpsrvd service daemon. T...

CVE-2017-18456

cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface SEC-217...

EUVD-2007-4097

Malware in sbrugna...

EUVD-2006-2615

Malware in sbrugna...

EUVD-2006-2616

Malware in sbrugna...

EUVD-2007-0886

Malware in sbrugna...

EUVD-2006-6181

Malware in sbrugna...

EUVD-2011-0530

Malware in sbrugna...

EUVD-2007-2267

Malware in sbrugna...

EUVD-2006-6531

Malware in sbrugna...

EUVD-2008-2896

Malware in sbrugna...

EUVD-2006-2617

Malware in sbrugna...

EUVD-2012-6301

Malware in sbrugna...

CVE-2020-25950

Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery CSRF attacks that can delete a contact from the My Additional Contact page...