Login Request a demo
CP
Product
Cpanel
by Cpanel · last CVE Sep 1, 2026
On CISA KEVExploited in the wildRansomware-linked
421
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities421In the news5Timeline
Severity mix
Critical 18High 104Medium 210Low 53
Severity
All severities421Critical18High104Medium210Low53
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Cpanel to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-20952
6.5
1%
Aug 1
cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
CVE-2016-10832
6.5
1%
Aug 1
cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10829
6.5
1%
Aug 1
cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2018-20934
6.5
1%
Aug 1
cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2018-20930
6.5
1%
Aug 1
cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2016-10849
6.5
1%
Aug 1
cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10844
6.5
1%
Aug 1
The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10842
6.5
1%
Aug 1
cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10838
6.5
1%
Aug 1
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10836
6.5
1%
Aug 1
cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10857
6.5
1%
Aug 1
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60)
Affected: 11.48.0.5 before 11.48.4.8; 11.50.0.4 before 11.50.3.1; 11.51.9999.98 before 11.52.0.23; 11.52.1.0 before 11.52.1.1
CVE-2016-10856
6.5
1%
Aug 1
cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29)
Affected: 11.48.0.5 before 11.48.4.8; 11.50.0.4 before 11.50.3.1; 11.51.9999.98 before 11.52.0.23; 11.52.1.0 before 11.52.1.1
CVE-2016-10852
6.5
1%
Aug 1
cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2018-20883
6.5
1%
Aug 1
cPanel before 74.0.8 allows FTP access during account suspension (SEC-449)
Affected: before 74.0.8
CVE-2018-20864
6.5
1%
Jul 30
cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454)
Affected: before 76.0.8
CVE-2017-18469
6.3
1%
Aug 5
cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233)
Affected: 55.9999.61 before 56.0.46; 57.9999.48 before 58.0.45; 59.9999.58 before 60.0.39; 61.9999.55 before 62.0.17
CVE-2017-18468
6.3
1%
Aug 5
cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232)
Affected: 55.9999.61 before 56.0.46; 57.9999.48 before 58.0.45; 59.9999.58 before 60.0.39; 61.9999.55 before 62.0.17
CVE-2017-18447
6.3
1%
Aug 2
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2017-18446
6.3
1%
Aug 2
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2017-18439
6.3
1%
Aug 2
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2017-18438
6.3
1%
Aug 2
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2017-18403
6.3
1%
Aug 2
cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2017-18389
6.3
1%
Aug 2
cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318)
Affected: 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2018-20931
6.3
1%
Aug 1
cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2018-20912
6.3
1%
Aug 1
cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362)
Affected: before 70.0.23
CVE-2018-20879
6.3
1%
Aug 1
cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444)
Affected: before 74.0.8
CVE-2023-29489
6.1
66%
Apr 27
An issue was discovered in cPanel before 11.109.9999.116
Affected: before 11.102.0.31; 11.104.0 before 11.106.0.18; 11.108.0 before 11.108.0.13; 11.109.0 before 11.109.9999.116
CVE-2021-31803
6.1
1%
Apr 26
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581)
Affected: before 94.0.3
CVE-2020-29137
6.1
1%
Nov 27
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577)
Affected: before 90.0.17
CVE-2020-26115
6.1
1%
Sep 25
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574)
Affected: before 90.0.10
CVE-2020-26114
6.1
1%
Sep 25
cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573)
Affected: before 90.0.10
CVE-2020-26113
6.1
1%
Sep 25
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569)
Affected: before 90.0.10
CVE-2020-26111
6.1
1%
Sep 25
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566)
Affected: before 90.0.10
CVE-2020-26110
6.1
1%
Sep 25
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564)
Affected: before 88.0.13
CVE-2020-10114
6.1
1%
Mar 17
cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535)
Affected: 77.9999.110 before 78.0.45; 83.9999.115 before 84.0.20
CVE-2020-10113
6.1
1%
Mar 17
cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515)
Affected: 77.9999.110 before 78.0.45; 83.9999.115 before 84.0.20
CVE-2019-20493
6.1
1%
Mar 17
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520)
Affected: 77.9999.110 before 78.0.43; 81.9999.242 before 82.0.18; 83.9999.115 before 84.0.10
CVE-2019-17380
6.1
1%
Oct 9
cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528)
Affected: before 82.0.15
CVE-2019-17379
6.1
1%
Oct 9
cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527)
Affected: 77.9999.110 before 78.0.39; 81.9999.242 before 82.0.15
CVE-2019-17378
6.1
1%
Oct 9
cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526)
Affected: 77.9999.110 before 78.0.39; 81.9999.242 before 82.0.15
CVE-2019-17377
6.1
1%
Oct 9
cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524)
Affected: 77.9999.110 before 78.0.39; 81.9999.242 before 82.0.15
CVE-2019-17376
6.1
0%
Oct 9
cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521)
Affected: 77.9999.110 before 78.0.39; 81.9999.242 before 82.0.15
CVE-2016-10795
6.1
1%
Aug 6
cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156)
Affected: 11.51.9999.98 before 11.52.6.6; 11.54.0.0 before 11.54.0.29; 55.9999.61 before 56.0.34; 57.9999.48 before 58.0.29; 59.9999.58 before 59.9999.145
CVE-2017-18472
6.1
1%
Aug 5
cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198)
Affected: 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2016-10769
6.1
1%
Aug 5
cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2017-18456
6.1
1%
Aug 2
cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217)
Affected: 55.9999.61 before 56.0.46; 57.9999.48 before 58.0.45; 59.9999.58 before 60.0.39; 61.9999.55 before 62.0.17
CVE-2018-20953
6.1
1%
Aug 1
cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
CVE-2018-20951
6.1
1%
Aug 1
cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
CVE-2018-20950
6.1
1%
Aug 1
cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
CVE-2018-20949
6.1
1%
Aug 1
cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
Page 4 of 9 · 421 total
1…345…9