cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318)

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405)

cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362)

cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444)

An issue was discovered in cPanel before 11.109.9999.116

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581)

cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577)

cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574)

cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573)

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569)

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566)

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564)

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535)

cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515)

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520)

cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528)

cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527)

cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526)

cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524)

cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521)

cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156)

cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198)

cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162)

cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217)

cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389)

cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387)

cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386)

cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385)

cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383)

cPanel before 70.0.23 allows an open redirect via the /unprotected/redirect.html endpoint (SEC-392)

cPanel before 70.0.23 allows stored XSS via the cpaddons vendor interface (SEC-391)

cPanel before 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377)

cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376)

cPanel before 70.0.23 allows stored XSS via a WHM "Delete a DNS Zone" action (SEC-375)

cPanel before 70.0.23 allows stored XSS via a WHM Edit DNS Zone action (SEC-374)

cPanel before 70.0.23 allows stored XSS via a WHM Create Account action (SEC-373)

cPanel before 70.0.23 allows stored XSS in WHM DNS Cluster (SEC-372)

cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357)

cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421)

cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400)

cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399)

cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398)

cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493)

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464)

cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461)

cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459)

cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462)

cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506)

cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering

Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1)…