WebPros cPanel and WHM Authentication Bypass via Login Flow

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system…

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed

Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response

SSL verification is disabled in the DNS Cluster system

Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled

Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account

HTTP Smuggling in cPanel allows potential leak of credentials