Login Request a demo
CP
Product
Cpanel
by Cpanel · last CVE Sep 1, 2026
On CISA KEVExploited in the wildRansomware-linked
421
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities421In the news5Timeline
Severity mix
Critical 18High 104Medium 210Low 53
Severity
All severities421Critical18High104Medium210Low53
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Cpanel to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2017-18462
7.5
1%
Aug 5
cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224)
Affected: 55.9999.61 before 56.0.46; 57.9999.48 before 58.0.45; 59.9999.58 before 60.0.39; 61.9999.55 before 62.0.17
CVE-2017-18431
7.5
1%
Aug 2
cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941)
Affected: 65.9999.38 before 66.0.1
CVE-2017-18406
7.5
1%
Aug 2
cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276)
Affected: 63.9999.74 before 64.0.40; 65.9999.38 before 66.0.23; 67.9999.64 before 67.9999.103
CVE-2016-10833
7.5
1%
Aug 1
cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10837
7.5
2%
Aug 1
cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2015-9291
7.5
1%
Aug 1
cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221)
Affected: before 11.52.0.13
CVE-2019-14388
7.5
1%
Jul 30
cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507)
Affected: before 82.0.2
CVE-2017-18414
7.4
1%
Aug 2
cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300)
Affected: before 56.0.52; 57.9999.48 before 60.0.48; 61.9999.55 before 62.0.30; 62.0.31 before 64.0.40; 64.0.42 before 66.0.23; 66.0.24 before 67.9999.103
CVE-2017-18435
7.3
1%
Aug 2
cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2018-20914
7.3
1%
Aug 1
In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368)
Affected: before 70.0.23
CVE-2021-38585
7.2
1%
Aug 11
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585)
Affected: before 98.0.1
CVE-2021-38584
7.2
1%
Aug 11
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585)
Affected: before 98.0.1
CVE-2020-10120
7.2
3%
Mar 17
cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545)
Affected: before 84.0.20
CVE-2020-10115
7.2
2%
Mar 17
cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin
Affected: 77.9999.110 before 78.0.45; 83.9999.115 before 84.0.20
CVE-2017-18387
7.2
2%
Aug 2
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2017-18386
7.2
2%
Aug 2
cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313)
Affected: 61.9999.55 before 62.0.35; 63.9999.74 before 64.0.42; 65.9999.38 before 66.0.34; 67.9999.64 before 68.0.15
CVE-2016-10831
7.2
1%
Aug 1
cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101)
Affected: 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10848
7.2
1%
Aug 1
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2018-20911
7.2
2%
Aug 1
cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359)
Affected: before 70.0.23
CVE-2018-20895
7.2
1%
Aug 1
In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393)
Affected: 67.9999.64 before 68.0.39; 69.9999.122 before 70.0.43; 71.9980.30 before 71.9980.37
CVE-2018-20909
7.1
0%
Aug 1
cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2019-14399
7.1
0%
Jul 30
The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477)
Affected: before 78.0.18
CVE-2016-10798
6.8
1%
Aug 7
cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134)
Affected: 55.9999.61 before 56.0.27; 57.9999.48 before 58.0.4
CVE-2017-18411
6.8
1%
Aug 2
The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285)
Affected: 55.9999.61 before 56.0.52; 59.9999.58 before 60.0.48; 61.9999.55 before 62.0.30; 64.0.0 before 64.0.40; 65.9999.38 before 66.0.23; 67.9999.64 before 67.9999.103
CVE-2018-20882
6.8
0%
Aug 1
cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447)
Affected: 69.9999.122 before 70.0.57; 73.9980.0 before 74.0.8
CVE-2017-18452
6.7
0%
Aug 2
cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2018-20926
6.7
0%
Aug 1
cPanel before 70.0.23 allows local privilege escalation via the WHM Locale XML Upload interface (SEC-380)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2018-20925
6.7
0%
Aug 1
cPanel before 70.0.23 allows local privilege escalation via the WHM Legacy Language File Upload interface (SEC-379)
Affected: 61.9999.55 before 62.0.42; 67.9999.64 before 68.0.33; 69.9999.122 before 70.0.23
CVE-2020-29136
6.5
1%
Nov 27
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575)
Affected: before 11.86.0.32; 11.90.0 before 11.90.0.17; 11.92.0 before 11.92.0.2
CVE-2020-10122
6.5
1%
Mar 17
cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547)
Affected: 77.9999.110 before 78.0.45; 83.9999.115 before 84.0.20
CVE-2019-20495
6.5
1%
Mar 17
cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531)
Affected: 81.9999.242 before 82.0.18; 83.9999.115 before 84.0.10
CVE-2016-10807
6.5
1%
Aug 7
cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112)
Affected: 11.50.0.4 before 11.50.6.2; 11.51.9999.98 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 55.9999.61 before 56.0.15; 57.9999.48 before 57.9999.54
CVE-2016-10794
6.5
1%
Aug 6
cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154)
Affected: 11.51.9999.98 before 11.52.6.6; 11.54.0.0 before 11.54.0.29; 55.9999.61 before 56.0.34; 57.9999.48 before 58.0.29; 59.9999.58 before 59.9999.145
CVE-2016-10786
6.5
1%
Aug 6
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10785
6.5
1%
Aug 6
cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2017-18482
6.5
1%
Aug 5
cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18480
6.5
1%
Aug 5
cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18479
6.5
0%
Aug 5
In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18478
6.5
1%
Aug 5
In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18477
6.5
1%
Aug 5
In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18474
6.5
1%
Aug 5
cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2016-10775
6.5
1%
Aug 5
cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10770
6.5
1%
Aug 5
cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10768
6.5
1%
Aug 5
cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2017-18410
6.5
1%
Aug 2
In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284)
Affected: 55.9999.61 before 56.0.52; 59.9999.58 before 60.0.48; 61.9999.55 before 62.0.30; 63.9999.74 before 64.0.40; 65.9999.38 before 66.0.23; 67.9999.64 before 67.9999.103
CVE-2017-18409
6.5
1%
Aug 2
In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283)
Affected: 55.9999.61 before 56.0.52; 59.9999.58 before 60.0.48; 61.9999.55 before 62.0.30; 63.9999.74 before 64.0.40; 65.9999.38 before 66.0.23; 67.9999.64 before 67.9999.103
CVE-2016-10821
6.5
1%
Aug 1
In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75)
Affected: 11.50.0.4 before 11.50.5.2; 11.52.0.5 before 11.52.4.1; 11.54.0.0 before 11.54.0.20
CVE-2016-10819
6.5
1%
Aug 1
In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125)
Affected: 11.50.0.4 before 11.50.6.2; 11.52.6.0 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 56.0.1 before 56.0.15
CVE-2016-10818
6.5
2%
Aug 1
cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124)
Affected: before 56.0.15
CVE-2016-10815
6.5
1%
Aug 1
cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120)
Affected: 11.50.0.4 before 11.50.6.2; 11.52.6.0 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 11.56.0.1 before 56.0.15
Page 3 of 9 · 421 total
1234…9