Login Request a demo
CP
Product
Control Panel
by Hestiacp · last CVE Jul 10, 2026
16
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities16In the news0Timeline
Severity mix
Critical 1High 6Medium 9Low 0
Severity
All severities16Critical1High6Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Control Panel to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-3797
9.8
1%
Sep 15
hestiacp is vulnerable to Use of Wrong Operator in String Comparison
Affected: through 1.4.12
CVE-2025-30007
8.8
3%
Jul 10
HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management
Affected: before 1.9.5
CVE-2022-2636
8.8
1%
Aug 5
Code Injection in hestiacp/hestiacp
Affected: before 1.6.6
CVE-2022-2550
8.8
49%
Jul 27
OS Command Injection in hestiacp/hestiacp
Affected: before 1.6.5
CVE-2022-1509
8.8
5%
Apr 28
Command Injection Vulnerability in hestiacp/hestiacp
Affected: before 1.5.12
CVE-2023-5839
7.8
0%
Oct 29
Privilege Chaining in hestiacp/hestiacp
Affected: before 1.8.9
CVE-2022-2626
7.2
1%
Aug 5
Incorrect Privilege Assignment in hestiacp/hestiacp
Affected: before 1.6.6
CVE-2020-10966
6.5
2%
Mar 25
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim…
Affected: before 1.1.1
CVE-2023-3479
6.1
1%
Jun 30
Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
Affected: before 1.7.8
CVE-2021-30071
6.1
1%
Aug 18
A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
Affected: before 1.3.5
CVE-2022-0986
6.1
1%
Mar 16
Reflected Cross-site Scripting (XSS) Vulnerability in hestiacp/hestiacp
Affected: before 1.5.11
CVE-2022-0752
6.1
1%
Mar 4
Cross-site Scripting (XSS) - Generic in hestiacp/hestiacp
Affected: before 1.5.9
CVE-2022-0838
6.1
1%
Mar 4
Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
Affected: before 1.5.10
CVE-2022-0753
6.1
1%
Mar 3
Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
Affected: before 1.5.9
CVE-2025-30008
5.4
0%
Jul 10
HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface
Affected: before 1.9.5
CVE-2021-27231
5.4
1%
Feb 16
Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name,…
Affected: through 1.3.5
Showing 16