CP
Product
Cpanel
On CISA KEVExploited in the wildRansomware-linked
420
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 17High 104Medium 210Low 53
Watch
Add Cpanel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-41940 RansomwareIn wildKEV | 9.8 | Apr 29 | WebPros cPanel and WHM Authentication Bypass via Login Flow Affected: 11.40 before 86.0.41; 88.0.0 before 110.0.97; 112.0.0 before 118.0.63; 120.0.0 before 124.0.35; 126.0.1 before 126.0.54; 128.0.0 before 130.0.19; +3 more |
| CVE-2020-26108 | 9.8 | Sep 25 | cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488) Affected: before 88.0.13 |
| CVE-2020-26105 | 9.8 | Sep 25 | In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554) Affected: before 88.0.3 |
| CVE-2020-26101 | 9.8 | Sep 25 | In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549) Affected: before 88.0.3 |
| CVE-2020-26100 | 9.8 | Sep 25 | chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497) Affected: before 88.0.3 |
| CVE-2020-26098 | 9.8 | Sep 25 | cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485) Affected: before 88.0.3 |
| CVE-2020-10121 | 9.8 | Mar 17 | cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546) Affected: 77.9999.110 before 78.0.45; 83.9999.115 before 84.0.20 |
| CVE-2020-10119 | 9.8 | Mar 17 | cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544) Affected: before 84.0.20 |
| CVE-2019-20498 | 9.8 | Mar 17 | cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534) Affected: 77.9999.110 before 78.0.43; 81.9999.242 before 82.0.18; 83.9999.115 before 84.0.10 |
| CVE-2016-10817 | 9.8 | Aug 1 | cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123) Affected: 11.50.0.4 before 11.50.6.2; 11.52.6.0 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 56.0.1 before 56.0.15 |
| CVE-2016-10824 | 9.8 | Aug 1 | cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90) Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141 |
| CVE-2016-10858 | 9.8 | Aug 1 | cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64) Affected: 11.48.0.5 before 11.48.4.8; 11.50.0.4 before 11.50.3.1; 11.51.9999.98 before 11.52.0.23; 11.52.1.0 before 11.52.1.1 |
| CVE-2016-10855 | 9.8 | Aug 1 | cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91) Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.52.2.1 before 11.52.2.4; 11.54.0.0 before 11.54.0.4 |
| CVE-2018-20887 | 9.8 | Aug 1 | cPanel before 74.0.0 allows SQL injection during database backups (SEC-420) Affected: before 74.0.0 |
| CVE-2018-20863 | 9.8 | Jul 30 | cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452) Affected: before 76.0.8 |
| CVE-2020-10118 | 9.1 | Mar 17 | cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543) Affected: 77.9999.110 before 78.0.45; 83.9999.115 before 84.0.20 |
| CVE-2020-10117 | 9.1 | Mar 17 | cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542) Affected: 77.9999.110 before 78.0.45; 83.9999.115 before 84.0.20 |
Showing 17