HE
Vendor
hestiacp
41
CVEs
0
On KEV
2
New 30D
Products
HE10.0
hestiacp
hestiacp
12 CVEs0 on KEV2 new
CP9.8
Control Panel
Hestiacp
16 CVEs0 on KEV0 new
HE9.8
hestiacp/hestiacp
hestiacp
13 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111627 | HE hestiacp hestiacp | 7.2 | Oct 16 | HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation |
| CVE-2026-108390 | HE hestiacp hestiacp | 9.9 | Oct 14 | HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking |
| CVE-2025-30008 | HE hestiacp hestiacp | 5.4 | Jul 10 | HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface |
| CVE-2025-30007 | HE hestiacp hestiacp | 8.8 | Jul 10 | HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management |
| CVE-2026-12196 | HE hestiacp hestiacp | 8.3 | Jul 4 | HestiaCP Admin Takeover |
| CVE-2026-43634 | HE hestiacp hestiacp | 7.5 | May 19 | HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header |
| CVE-2026-43633 | HE hestiacp hestiacp | 10.0 | May 19 | HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal |
| CVE-2023-5839 | HE hestiacp/hestiacp hestiacp | 7.8 | Oct 29 | Privilege Chaining in hestiacp/hestiacp |
| CVE-2023-4517 | HE hestiacp/hestiacp hestiacp | 5.4 | Oct 13 | Cross-site Scripting (XSS) - Stored in hestiacp/hestiacp |
| CVE-2023-5084 | HE hestiacp/hestiacp hestiacp | 6.1 | Sep 20 | Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp |
| CVE-2023-3479 | HE hestiacp/hestiacp hestiacp | 6.1 | Jun 30 | Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp |
| CVE-2021-30071 | CP Control Panel Hestiacp | 6.1 | Aug 18 | A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload |
| CVE-2021-30070 | HE Hestiacp Hestiacp | 7.5 | Aug 18 | An issue was discovered in HestiaCP before v1.3.5 |
| CVE-2022-2636 | HE hestiacp/hestiacp hestiacp | 8.8 | Aug 5 | Code Injection in hestiacp/hestiacp |
| CVE-2022-2626 | HE hestiacp/hestiacp hestiacp | 7.2 | Aug 5 | Incorrect Privilege Assignment in hestiacp/hestiacp |
| CVE-2022-2550 | HE hestiacp/hestiacp hestiacp | 8.8 | Jul 27 | OS Command Injection in hestiacp/hestiacp |
| CVE-2022-1509 | HE hestiacp/hestiacp hestiacp | 8.8 | Apr 28 | Command Injection Vulnerability in hestiacp/hestiacp |
| CVE-2022-0986 | HE hestiacp/hestiacp hestiacp | 6.1 | Mar 16 | Reflected Cross-site Scripting (XSS) Vulnerability in hestiacp/hestiacp |
| CVE-2022-0752 | HE hestiacp/hestiacp hestiacp | 6.1 | Mar 4 | Cross-site Scripting (XSS) - Generic in hestiacp/hestiacp |
| CVE-2022-0838 | HE hestiacp/hestiacp hestiacp | 6.1 | Mar 4 | Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp |
| CVE-2022-0753 | HE hestiacp/hestiacp hestiacp | 6.1 | Mar 3 | Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp |
| CVE-2021-3797 | HE hestiacp/hestiacp hestiacp | 9.8 | Sep 15 | Use of Wrong Operator in String Comparison in hestiacp/hestiacp |
| CVE-2021-27231 | CP Control Panel Hestiacp | 5.4 | Feb 16 | Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name,… |
| CVE-2020-10966 | CP Control Panel Hestiacp | 6.5 | Mar 25 | In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim… |