Login Request a demo
CP
Product
Cpanel
by Cpanel · last CVE Sep 1, 2026
On CISA KEVExploited in the wildRansomware-linked
421
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities421In the news5Timeline
Severity mix
Critical 18High 104Medium 210Low 53
Severity
All severities421Critical18High104Medium210Low53
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Cpanel to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2016-10783
5.4
1%
Aug 6
cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10782
5.4
1%
Aug 6
cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10781
5.4
1%
Aug 6
cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10780
5.4
1%
Aug 6
cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10779
5.4
1%
Aug 6
cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10778
5.4
1%
Aug 6
cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10777
5.4
1%
Aug 6
cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10776
5.4
1%
Aug 6
cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2017-18481
5.4
1%
Aug 5
cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18473
5.4
1%
Aug 5
cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18471
5.4
1%
Aug 5
cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2016-10774
5.4
1%
Aug 5
cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172)
Affected: 59.9999.58 before 60.0.25
CVE-2016-10767
5.4
1%
Aug 5
cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2017-18454
5.4
1%
Aug 2
cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24
CVE-2017-18420
5.4
1%
Aug 2
cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269)
Affected: before 66.0.2
CVE-2017-18419
5.4
1%
Aug 2
cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266)
Affected: before 66.0.2
CVE-2017-18418
5.4
1%
Aug 2
cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265)
Affected: before 66.0.2
CVE-2017-18417
5.4
1%
Aug 2
cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263)
Affected: before 66.0.2
CVE-2017-18408
5.4
1%
Aug 2
cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282)
Affected: 55.9999.61 before 56.0.52; 59.9999.58 before 60.0.48; 61.9999.55 before 62.0.30; 63.9999.74 before 64.0.40; 65.9999.38 before 66.0.23; 67.9999.64 before 67.9999.103
CVE-2017-18402
5.4
1%
Aug 2
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2016-10813
5.4
1%
Aug 1
cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118)
Affected: 11.54.0.1 before 11.54.0.24; 55.9999.61 before 56.0.15; 57.9999.48 before 57.9999.54
CVE-2016-10827
5.4
1%
Aug 1
cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10822
5.4
1%
Aug 1
cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2018-20935
5.4
1%
Aug 1
cPanel before 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.125 before 70.0.23
CVE-2018-20933
5.4
1%
Aug 1
cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2018-20916
5.4
1%
Aug 1
cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370)
Affected: before 70.0.23
CVE-2018-20915
5.4
1%
Aug 1
cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-369)
Affected: before 70.0.23
CVE-2018-20905
5.4
1%
Aug 1
cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429)
Affected: 61.9999.55 before 62.0.47; 67.9999.64 before 68.0.39; 69.9999.122 before 70.0.43; 71.9980.30 before 71.9980.37
CVE-2016-10854
5.4
1%
Aug 1
cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.52.2.1 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10853
5.4
1%
Aug 1
cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86)
Affected: 11.48.0.5 before 11.48.4.8; 11.54.0.0 before 11.54.0.4
CVE-2016-10851
5.4
1%
Aug 1
cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.52.2.1 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2018-20884
5.4
1%
Aug 1
cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367)
Affected: before 74.0.0
CVE-2018-20881
5.4
1%
Aug 1
cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446)
Affected: before 74.0.8
CVE-2018-20878
5.4
1%
Aug 1
cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441)
Affected: before 74.0.8
CVE-2018-20877
5.4
1%
Aug 1
cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437)
Affected: before 74.0.8
CVE-2018-20876
5.4
1%
Aug 1
cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434)
Affected: before 74.0.8
CVE-2018-20875
5.4
1%
Aug 1
cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433)
Affected: before 74.0.8
CVE-2018-20874
5.4
1%
Aug 1
cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428)
Affected: 69.9999.122 before 70.0.57; 73.9980.0 before 74.0.8
CVE-2019-14390
5.4
1%
Jul 30
cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512)
Affected: before 82.0.2
CVE-2019-14386
5.4
1%
Jul 30
cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504)
Affected: before 82.0.2
CVE-2020-12784
5.3
1%
May 11
cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505)
Affected: 11.78.0.1 before 11.78.0.47; 11.84.0.0 before 11.84.0.22; 11.86.0.1 before 11.86.0.14
CVE-2020-10116
5.3
1%
Mar 17
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541)
Affected: 77.9999.110 before 78.0.45; 83.9999.115 before 84.0.20
CVE-2016-10791
5.3
1%
Aug 6
cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559)
Affected: 59.9999.58 before 60.0.15
CVE-2017-18451
5.3
1%
Aug 2
cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257)
Affected: 56.0.1 before 56.0.49; 58.0.3 before 58.0.49; 60.0.3 before 60.0.43; 62.0.1 before 62.0.24; 64.0.0 before 64.0.21
CVE-2017-18448
5.3
1%
Aug 2
cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2017-18444
5.3
1%
Aug 2
cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2017-18442
5.3
1%
Aug 2
cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2016-10841
5.3
1%
Aug 1
The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2018-20886
5.3
0%
Aug 1
cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418)
Affected: 69.9999.122 before 70.0.53; 71.9980.30 before 72.0.10; 73.9980.0 before 74.0.0
CVE-2018-20885
5.3
1%
Aug 1
cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416)
Affected: before 74.0.0
Page 6 of 9 · 421 total
1…567…9