Login Request a demo
CP
Product
Cpanel
by Cpanel · last CVE Sep 1, 2026
On CISA KEVExploited in the wildRansomware-linked
421
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities421In the news5Timeline
Severity mix
Critical 18High 104Medium 210Low 53
Severity
All severities421Critical18High104Medium210Low53
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Cpanel to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-20944
3.3
0%
Aug 1
cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
CVE-2018-20940
3.3
0%
Aug 1
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
CVE-2018-20939
3.3
0%
Aug 1
cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
CVE-2018-20936
3.3
0%
Aug 1
cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
CVE-2018-20894
3.3
0%
Aug 1
cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443)
Affected: 71.9980.30 before 72.0.10; 73.9980.0 before 74.0.0
CVE-2018-20880
3.3
0%
Aug 1
cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445)
Affected: before 74.0.8
CVE-2018-20873
3.3
0%
Aug 1
cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409)
Affected: 69.9999.122 before 70.0.57; 73.9980.0 before 74.0.8
CVE-2019-14414
3.3
0%
Jul 30
In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478)
Affected: before 78.0.2
CVE-2019-14412
3.3
0%
Jul 30
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474)
Affected: before 78.0.2
CVE-2019-14410
3.3
0%
Jul 30
Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472)
Affected: before 78.0.2
CVE-2019-14402
3.3
0%
Jul 30
cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481)
Affected: before 78.0.18
CVE-2019-14396
3.3
0%
Jul 30
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495)
Affected: before 80.0.5
CVE-2019-14395
3.3
0%
Jul 30
cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494)
Affected: before 80.0.5
CVE-2019-14391
3.3
0%
Jul 30
cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514)
Affected: before 82.0.2
CVE-2017-18404
3.1
0%
Aug 2
cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2018-20897
2.8
0%
Aug 1
cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395)
Affected: 61.9999.55 before 62.0.47; 67.9999.64 before 68.0.39; 69.9999.122 before 70.0.43; 71.9980.30 before 71.9980.37
CVE-2017-18466
2.7
1%
Aug 5
cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228)
Affected: 55.9999.61 before 56.0.46; 57.9999.48 before 58.0.45; 59.9999.58 before 60.0.39; 61.9999.55 before 62.0.17
CVE-2017-18455
2.7
1%
Aug 2
In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208)
Affected: 55.9999.61 before 56.0.46; 57.9999.48 before 58.0.45; 59.9999.58 before 60.0.39; 61.9999.55 before 62.0.17
CVE-2017-18426
2.7
1%
Aug 2
cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288)
Affected: before 66.0.2
CVE-2017-18401
2.7
1%
Aug 2
cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2017-18395
2.7
1%
Aug 2
cPanel before 68.0.15 does not block a username of ssl (SEC-328)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2017-18394
2.7
1%
Aug 2
cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2017-18393
2.7
1%
Aug 2
cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2017-18382
2.7
1%
Aug 2
cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2018-20938
2.7
1%
Aug 1
cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324)
Affected: 67.9999.64 before 68.0.27
CVE-2018-20932
2.7
1%
Aug 1
cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2019-14407
2.7
1%
Jul 30
cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415)
Affected: before 78.0.2
CVE-2017-18428
2.5
0%
Aug 2
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290)
Affected: 55.9999.61 before 56.0.51; 57.9999.48 before 58.0.52; 59.9999.58 before 60.0.45; 61.9999.55 before 62.0.27; 63.9999.74 before 64.0.33; 65.9999.38 before 66.0.2
CVE-2017-18425
2.5
0%
Aug 2
In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280)
Affected: 56.0.1 before 56.0.51; 58.0.3 before 58.0.52; 60.0.3 before 60.0.45; 62.0.1 before 62.0.27; 64.0.0 before 64.0.33; 66.0.1 before 66.0.2
CVE-2017-18412
2.5
0%
Aug 2
cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296)
Affected: 55.9999.61 before 56.0.52; 59.9999.58 before 60.0.48; 61.9999.55 before 62.0.30; 64.0.0 before 64.0.40; 65.9999.38 before 66.0.23; 67.9999.64 before 67.9999.103
CVE-2017-18391
2.5
0%
Aug 2
cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2018-20943
2.5
0%
Aug 1
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
CVE-2018-20942
2.5
0%
Aug 1
cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351)
Affected: 61.9999.55 before 62.0.39; 65.9999.38 before 66.0.35; 67.9999.64 before 68.0.27
CVE-2018-20893
2.3
0%
Aug 1
cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442)
Affected: 69.9999.122 before 70.0.53; 71.9980.30 before 72.0.10; 73.9980.0 before 74.0.0
CVE-2017-18392
2.0
1%
Aug 2
cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325)
Affected: 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2009-4823
–
2%
Apr 27
Cross-site scripting (XSS) vulnerability in frontend/x3/files/fileop.html in cPanel 11.0 through 11.24.7 allows remote attackers to inject arbitrary web script or HTML via the…
Affected: 11.0; 11.4.19; 11.16; 11.18; 11.18.1; 11.18.2; +11 more
CVE-2008-7142
–
3%
Sep 1
Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers to list arbitrary directories via the…
Affected: 11.18.3
CVE-2008-6927
–
4%
Aug 10
Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary…
Affected: All versions, or not specified
CVE-2008-6843
–
7%
Jul 2
Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a
Affected: 11; 11.4.19; 11.8.6; 11.8.6_stable; 11.16; 11.18; +13 more
CVE-2009-2275
–
4%
Jul 1
Directory traversal vulnerability in frontend/x3/stats/lastvisit.html in cPanel allows remote attackers to read arbitrary files via a
Affected: All versions, or not specified
CVE-2008-2478
–
4%
May 28
scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell…
Affected: through 11.8.6; through 11.23.1
CVE-2008-2071
–
1%
May 12
Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote attackers to perform…
Affected: 11.18; 11.18.1; 11.18.2; 11.18.3; 11.22; 11.22.1; +1 more
CVE-2008-2070
–
2%
May 12
The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via…
Affected: 11.18; 11.18.1; 11.18.2; 11.18.3; 11.22; 11.22.1; +1 more
CVE-2008-2043
–
1%
May 1
Multiple cross-site request forgery (CSRF) vulnerabilities in cPanel, possibly 11.18.3 and 11.19.3, allow remote attackers to (1) execute arbitrary code via the command1 parameter…
Affected: 11.18.3; 11.19.3
CVE-2008-1499
–
1%
Mar 25
Cross-site scripting (XSS) vulnerability in frontend/x/manpage.html in cPanel 11.18.3 and 11.21.0-BETA allows remote attackers to inject arbitrary web script or HTML via the query…
Affected: 11.18.3; 11.21
CVE-2008-0370
–
1%
Jan 22
Cross-site scripting (XSS) vulnerability in dohtaccess.html in cPanel before 11.17 build 19417 allows remote attackers to inject arbitrary web script or HTML via the rurl…
Affected: 11.16
CVE-2007-4022
–
2%
Jul 26
Cross-site scripting (XSS) vulnerability in frontend/x/htaccess/changepro.html in cPanel 10.9.1 allows remote attackers to inject arbitrary web script or HTML via the resname…
Affected: 10.9.1
CVE-2007-3366
–
1%
Jun 22
Cross-site scripting (XSS) vulnerability in Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to inject arbitrary web…
Affected: through 10.9.0_build_10300; through 11.4.19
CVE-2007-3367
–
1%
Jun 22
Simple CGI Wrapper (scgiwrap) in cPanel before 10.9.1, and 11.x before 11.4.19-R14378, allows remote attackers to obtain sensitive information via a direct request, which reveals…
Affected: through 10.9.0_build_10300; through 11.4.19
CVE-2006-6523
–
2%
Dec 14
Cross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter
Affected: 11
Page 8 of 9 · 421 total
1…789