CP
Product
Cpanel
On CISA KEVExploited in the wildRansomware-linked
421
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 18High 104Medium 210Low 53
Watch
Add Cpanel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-20907 | 4.3 | Aug 1 | cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432) Affected: 61.9999.55 before 62.0.47; 67.9999.64 before 68.0.39; 69.9999.122 before 70.0.43; 71.9980.30 before 71.9980.37 |
| CVE-2018-20906 | 4.3 | Aug 1 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430) Affected: 61.9999.55 before 62.0.47; 67.9999.64 before 68.0.39; 69.9999.122 before 70.0.43 |
| CVE-2018-20904 | 4.3 | Aug 1 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427) Affected: 61.9999.55 before 62.0.47; 67.9999.64 before 68.0.39; 69.9999.122 before 70.0.43 |
| CVE-2018-20898 | 4.3 | Aug 1 | cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396) Affected: 61.9999.55 before 62.0.47; 67.9999.64 before 68.0.39; 69.9999.122 before 70.0.43 |
| CVE-2018-20892 | 4.3 | Aug 1 | cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439) Affected: 69.9999.122 before 70.0.53; 71.9980.30 before 72.0.10; 73.9980.0 before 74.0.0 |
| CVE-2018-20890 | 4.3 | Aug 1 | cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426) Affected: 69.9999.122 before 70.0.53; 71.9980.30 before 72.0.10; 73.9980.0 before 74.0.0 |
| CVE-2019-14413 | 4.3 | Jul 30 | cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476) Affected: before 78.0.2 |
| CVE-2019-14408 | 4.3 | Jul 30 | cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460) Affected: before 78.0.2 |
| CVE-2019-14403 | 4.3 | Jul 30 | cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483) Affected: before 78.0.18 |
| CVE-2020-29135 | 4.1 | Nov 27 | cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567) Affected: before 90.0.17 |