CP
Product
Cpanel
On CISA KEVExploited in the wildRansomware-linked
420
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 17High 104Medium 210Low 53
Watch
Add Cpanel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2006-5535 | – | Oct 26 | Multiple cross-site scripting (XSS) vulnerabilities in WebHostManager (WHM) 10.8.0 cPanel 10.9.0 R50 allow remote attackers to inject arbitrary web script or HTML via the (1)… Affected: 10.9.0_r50 |
| CVE-2006-4293 | – | Aug 22 | Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the… Affected: 10 |
| CVE-2006-3337 | – | Jul 3 | Cross-site scripting (XSS) vulnerability in frontend/x/files/select.html in cPanel 10.8.2-CURRENT 118 and earlier allows remote attackers to inject arbitrary web script or HTML… Affected: through 10.8.2_current_118 |
| CVE-2006-2825 | – | Jun 5 | cPanel does not automatically synchronize the PHP open_basedir configuration directive between the main server and virtual hosts that share physical directories, which might allow… Affected: All versions, or not specified |
| CVE-2006-0763 | – | Feb 18 | Cross-site scripting (XSS) vulnerability in dowebmailforward.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via a URL encoded value in the fwd… Affected: All versions, or not specified |
| CVE-2006-0573 | – | Feb 7 | Multiple cross-site scripting (XSS) vulnerabilies in cPanel 10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to (a)… Affected: 5.0; 5.3; 6.0; 6.2; 6.4; 6.4.1; +7 more |
| CVE-2006-0574 | – | Feb 7 | Cross-site scripting (XSS) vulnerability in mime/handle.html in cPanel 10 allows remote attackers to inject arbitrary web script or HTML via the (1) file extension or (2)… Affected: 10 |
| CVE-2006-0533 | – | Feb 4 | Cross-site scripting (XSS) vulnerability in webmailaging.cgi in cPanel allows remote attackers to inject arbitrary web script or HTML via the numdays parameter Affected: All versions, or not specified |
| CVE-2005-3505 | – | Nov 5 | Cross-site scripting (XSS) vulnerability in the Entropy Chat script in cPanel 10.2.0-R82 and 10.6.0-R137 allows remote attackers to inject arbitrary web script or HTML via a chat… Affected: 10.2.0_r82; 10.6.0_r137 |
| CVE-2005-2021 | – | Jun 20 | Cross-site scripting (XSS) vulnerability in cPanel 9.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the user parameter in the login page Affected: 5.0; 5.3; 6.0; 6.2; 6.4; 6.4.1; +6 more |
| CVE-2004-2308 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the dir parameter in… Affected: 5.0; 5.3; 6.0; 6.2; 6.4; 6.4.1; +6 more |
| CVE-2004-1604 | – | Sep 30 | cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the _private directory, which is created when Front Page extensions are… Affected: 9.9.1_r3 |
| CVE-2004-0490 | – | Aug 18 | cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to… Affected: 5.0; 5.3; 6.0; 6.2; 6.4; 6.4.1; +7 more |
| CVE-2004-1875 | – | Mar 30 | Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html,… Affected: 9.1.0_r85 |
| CVE-2004-1849 | – | Mar 24 | Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to dodelautores.html… Affected: 9.1 |
| CVE-2004-1770 | – | Mar 11 | The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter Affected: 5.0; 5.3; 6.0; 6.2; 6.4; 6.4.1; +6 more |
| CVE-2004-1769 | – | Mar 11 | The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the… Affected: 5.0; 5.3; 6.0; 6.2; 6.4; 6.4.1; +6 more |
| CVE-2003-1426 | – | Dec 31 | Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to… Affected: 5.0 |
| CVE-2003-1425 | – | Dec 31 | guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter Affected: 5.0 |
| CVE-2003-0521 | – | Aug 18 | Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL… Affected: 5.0; 5.3; 6.0; 6.2; 6.4; 6.4.1; +2 more |