cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96)

cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412)

cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410)

cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84)

cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370)

cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369)

cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86)

cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87)

cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429)

cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367)

cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446)

cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441)

cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437)

cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434)

cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433)

cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428)

cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512)

cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504)

cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505)

cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541)

cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559)

cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257)

cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252)

cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248)

cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246)

The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73)

cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418)

cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416)

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473)

cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496)

cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486)

cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245)

cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226)

cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260)

cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364)

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279)

In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294)

cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255)

In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589)

cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227)

cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218)

cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240)

cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425)

cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133)

cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229)

cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223)

cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249)

cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244)

cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321)

cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107)