Login Request a demo
CP
Product
Cpanel
by Cpanel · last CVE Sep 1, 2026
On CISA KEVExploited in the wildRansomware-linked
420
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities420In the news5Timeline
Severity mix
Critical 17High 104Medium 210Low 53
Severity
All severities420Critical17High104Medium210Low53
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Cpanel to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2016-10798
6.8
1%
Aug 7
cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134)
Affected: 55.9999.61 before 56.0.27; 57.9999.48 before 58.0.4
CVE-2017-18411
6.8
1%
Aug 2
The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285)
Affected: 55.9999.61 before 56.0.52; 59.9999.58 before 60.0.48; 61.9999.55 before 62.0.30; 64.0.0 before 64.0.40; 65.9999.38 before 66.0.23; 67.9999.64 before 67.9999.103
CVE-2018-20882
6.8
0%
Aug 1
cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447)
Affected: 69.9999.122 before 70.0.57; 73.9980.0 before 74.0.8
CVE-2017-18452
6.7
0%
Aug 2
cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2018-20926
6.7
0%
Aug 1
cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface (SEC-380)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2018-20925
6.7
0%
Aug 1
cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface (SEC-379)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2020-29136
6.5
1%
Nov 27
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575)
Affected: before 11.86.0.32; 11.90.0 before 11.90.0.17; 11.92.0 before 11.92.0.2
CVE-2020-10122
6.5
1%
Mar 17
cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547)
Affected: 77.9999.110 before 78.0.45; 83.9999.115 before 84.0.20
CVE-2019-20495
6.5
1%
Mar 17
cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531)
Affected: 81.9999.242 before 82.0.18; 83.9999.115 before 84.0.10
CVE-2016-10807
6.5
1%
Aug 7
cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112)
Affected: 11.50.0.4 before 11.50.6.2; 11.51.9999.98 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 55.9999.61 before 56.0.15; 57.9999.48 before 57.9999.54
CVE-2016-10794
6.5
1%
Aug 6
cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154)
Affected: 11.51.9999.98 before 11.52.6.6; 11.54.0.0 before 11.54.0.29; 55.9999.61 before 56.0.34; 57.9999.48 before 58.0.29; 59.9999.58 before 59.9999.145
CVE-2016-10786
6.5
1%
Aug 6
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10785
6.5
1%
Aug 6
cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2017-18482
6.5
1%
Aug 5
cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18480
6.5
1%
Aug 5
cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18479
6.5
0%
Aug 5
In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18478
6.5
1%
Aug 5
In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18477
6.5
1%
Aug 5
In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18474
6.5
1%
Aug 5
cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2016-10775
6.5
1%
Aug 5
cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10770
6.5
1%
Aug 5
cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10768
6.5
1%
Aug 5
cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2017-18410
6.5
1%
Aug 2
In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284)
Affected: 55.9999.61 before 56.0.52; 59.9999.58 before 60.0.48; 61.9999.55 before 62.0.30; 63.9999.74 before 64.0.40; 65.9999.38 before 66.0.23; 67.9999.64 before 67.9999.103
CVE-2017-18409
6.5
1%
Aug 2
In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283)
Affected: 55.9999.61 before 56.0.52; 59.9999.58 before 60.0.48; 61.9999.55 before 62.0.30; 63.9999.74 before 64.0.40; 65.9999.38 before 66.0.23; 67.9999.64 before 67.9999.103
CVE-2016-10821
6.5
1%
Aug 1
In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75)
Affected: 11.50.0.4 before 11.50.5.2; 11.52.0.5 before 11.52.4.1; 11.54.0.0 before 11.54.0.20
CVE-2016-10819
6.5
1%
Aug 1
In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125)
Affected: 11.50.0.4 before 11.50.6.2; 11.52.6.0 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 56.0.1 before 56.0.15
CVE-2016-10818
6.5
2%
Aug 1
cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124)
Affected: before 56.0.15
CVE-2016-10815
6.5
1%
Aug 1
cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120)
Affected: 11.50.0.4 before 11.50.6.2; 11.52.6.0 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 11.56.0.1 before 56.0.15
CVE-2018-20952
6.5
1%
Aug 1
cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
CVE-2016-10832
6.5
1%
Aug 1
cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10829
6.5
1%
Aug 1
cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2018-20934
6.5
1%
Aug 1
cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2018-20930
6.5
1%
Aug 1
cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2016-10849
6.5
1%
Aug 1
cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10844
6.5
1%
Aug 1
The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10842
6.5
1%
Aug 1
cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10838
6.5
1%
Aug 1
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10836
6.5
1%
Aug 1
cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10857
6.5
1%
Aug 1
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60)
Affected: 11.48.0.5 before 11.48.4.8; 11.50.0.4 before 11.50.3.1; 11.51.9999.98 before 11.52.0.23; 11.52.1.0 before 11.52.1.1
CVE-2016-10856
6.5
1%
Aug 1
cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29)
Affected: 11.48.0.5 before 11.48.4.8; 11.50.0.4 before 11.50.3.1; 11.51.9999.98 before 11.52.0.23; 11.52.1.0 before 11.52.1.1
CVE-2016-10852
6.5
1%
Aug 1
cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2018-20883
6.5
1%
Aug 1
cPanel before 74.0.8 allows FTP access during account suspension (SEC-449)
Affected: before 74.0.8
CVE-2018-20864
6.5
1%
Jul 30
cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454)
Affected: before 76.0.8
CVE-2017-18469
6.3
1%
Aug 5
cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233)
Affected: 55.9999.61 before 56.0.46; 57.9999.48 before 58.0.45; 59.9999.58 before 60.0.39; 61.9999.55 before 62.0.17
CVE-2017-18468
6.3
1%
Aug 5
cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232)
Affected: 55.9999.61 before 56.0.46; 57.9999.48 before 58.0.45; 59.9999.58 before 60.0.39; 61.9999.55 before 62.0.17
CVE-2017-18447
6.3
1%
Aug 2
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2017-18446
6.3
1%
Aug 2
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2017-18439
6.3
1%
Aug 2
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2017-18438
6.3
1%
Aug 2
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2017-18403
6.3
1%
Aug 2
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
Page 1 of 5 · 210 total
12…5