CP
Product
Cpanel
On CISA KEVExploited in the wildRansomware-linked
420
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 17High 104Medium 210Low 53
Watch
Add Cpanel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-20911 | 7.2 | Aug 1 | cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359) Affected: before 70.0.23 |
| CVE-2018-20895 | 7.2 | Aug 1 | In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393) Affected: 67.9999.64 before 68.0.39; 69.9999.122 before 70.0.43; 71.9980.30 before 71.9980.37 |
| CVE-2018-20909 | 7.1 | Aug 1 | cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338) Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23 |
| CVE-2019-14399 | 7.1 | Jul 30 | The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477) Affected: before 78.0.18 |