CVE-2018-20938

cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).

CVE-2018-20944

cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353).

CVE-2020-10117

cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).

CVE-2020-10122

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).

CVE-2020-26102

In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).

CVE-2020-26110

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).

CVE-2016-10822

cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88).

CVE-2016-10829

cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).

CVE-2018-20939

cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339).

CVE-2020-29137

cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).

CVE-2021-26267

cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).

CVE-2016-10849

cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).

CVE-2017-5614

Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter.

CVE-2018-20952

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388).

CVE-2020-10113

cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).

CVE-2020-26107

cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).

CVE-2004-1770

The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter.

CVE-2018-20899

cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).

CVE-2018-20945

bin/csvprocess in cPanel before 68.0.27 allows insecure file operations (SEC-354).

CVE-2019-20497

cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).

CVE-2008-2071

Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote attackers to perform unauthorized actions as cPanel administrators via requests to cpanel/whm/webmail and other unspecified vectors.

CVE-2008-6843

Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a .. (dot dot) in the sup3r parameter.

CVE-2016-10831

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).

CVE-2018-20917

cPanel before 70.0.23 allows any user to disable Solr (SEC-371).

CVE-2018-20948

cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383).

CVE-2018-20950

cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386).

CVE-2019-20495

cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).

CVE-2020-26113

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).

CVE-2006-6523

Cross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter.

CVE-2008-6927

Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary web script or HTML via the (1) localapp, (2) updatedir, (3) scriptpath_show, (4) domain_show, (5) thispage, (6) thisapp,...

CVE-2008-7142

Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers to list arbitrary directories via the showtree parameter.

CVE-2016-10818

cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).

CVE-2018-20891

cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436).

CVE-2003-0521

Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the (1) Error Log or (2) Latest Visitors screens.

CVE-2016-10824

cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90).

CVE-2017-18393

cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326).

CVE-2017-18470

cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).

CVE-2017-18477

In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).

CVE-2017-18481

cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).

CVE-2018-20946

cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script (SEC-355).

CVE-2019-20496

cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).

CVE-2020-26111

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).

CVE-2016-10823

cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89).

CVE-2017-18435

cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).

CVE-2017-18443

cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).

CVE-2019-20490

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).

CVE-2020-12784

cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).

CVE-2020-26112

The email quota cache in cPanel before 90.0.10 allows overwriting of files.

CVE-2005-2021

Cross-site scripting (XSS) vulnerability in cPanel 9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the user parameter in the login page.

CVE-2006-0574

Cross-site scripting (XSS) vulnerability in mime/handle.html in cPanel 10 allows remote attackers to inject arbitrary web script or HTML via the (1) file extension or (2) mime-type.