Medium severity · published Jul 19, 2017
CVE-2017-11441
The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66.0.2 has XSS via a…
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66.0.2 has XSS via a locale filename, aka SEC-297.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
Whm · Cpanel
through 56.0.50; 58.0.3; 58.0.4; 58.0.5; 58.0.6; 58.0.7; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-11441
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-11441
Vendor Advisory
https://news.cpanel.com/cpanel-tsr-2017-0004-full-disclosure/
More from Whm
9.8
CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
8.6
CVE-2026-29205
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints
8.2
CVE-2026-32992
SSL verification is disabled in the DNS Cluster system
5.4
CVE-2012-6449
The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability