CVE-2019-17379

cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface SEC-527...

CVE-2018-20901

cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface SEC-400...

CVE-2018-20923

cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action SEC-377...

CVE-2018-20922

cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action SEC-376...

CVE-2018-20877

cPanel before 74.0.8 allows self XSS in WHM Style Upload interface SEC-437...

CVE-2018-20910

cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface SEC-357...

CVE-2018-20896

cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface SEC-394...

CVE-2018-20919

cPanel before 70.0.23 allows stored XSS via a WHM Create Account action SEC-373...

CVE-2018-20884

cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface SEC-367...

CVE-2016-10827

cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences SEC-96...

CVE-2016-10777

cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscoverhost SEC-177...

CVE-2018-20913

cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi SEC-364...

CVE-2018-20924

cPanel before 70.0.23 allows arbitrary file-read and file-unlink operations via WHM style uploads SEC-378...

CVE-2017-18479

In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address SEC-209...

CVE-2017-18417

cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation SEC-263...

CVE-2017-18481

cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface SEC-211...

CVE-2017-18418

cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations SEC-265...

CVE-2005-3687

cancelaccount.php in WHM AutoPilot 2.5.30 and earlier allows remote attackers to cancel requests for arbitrary accounts via a modified c parameter...

CVE-2025-43921

GNU Mailman 2.1.39, as bundled in cPanel and WHM, allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used...

CVE-2025-43919

GNU Mailman 2.1.39, as bundled in cPanel and WHM, allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman aka the private archive authentication endpoint via the username parameter. NOTE: multiple third parties report that they are unable t...