U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:cpanel:cpanel:11.108.0:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 114 matching records.
Displaying matches 1 through 20.
Vuln ID Summary CVSS Severity
CVE-2023-29489

An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.

Published: April 27, 2023; 5:15:10 PM -0400 		V4.0:(not available)
 V3.1: 6.1 MEDIUM
V2.0:(not available)
CVE-2021-38588

In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).

Published: August 11, 2021; 7:15:08 PM -0400 		V4.0:(not available)
 V3.1: 8.1 HIGH
V2.0: 6.8 MEDIUM
CVE-2021-38587

In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).

Published: August 11, 2021; 7:15:08 PM -0400 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2021-38585

The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).

Published: August 11, 2021; 7:15:08 PM -0400 		V4.0:(not available)
 V3.1: 7.2 HIGH
V2.0: 6.5 MEDIUM
CVE-2021-38584

The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).

Published: August 11, 2021; 7:15:08 PM -0400 		V4.0:(not available)
 V3.1: 7.2 HIGH
V2.0: 6.5 MEDIUM
CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).

Published: April 26, 2021; 4:15:07 AM -0400 		V4.0:(not available)
 V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2021-26267

cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).

Published: January 26, 2021; 1:16:25 PM -0500 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2021-26266

cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).

Published: January 26, 2021; 1:16:25 PM -0500 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2020-29137

cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).

Published: November 26, 2020; 9:15:11 PM -0500 		V4.0:(not available)
 V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2020-29135

cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).

Published: November 26, 2020; 9:15:10 PM -0500 		V4.0:(not available)
 V3.1: 4.1 MEDIUM
V2.0: 3.5 LOW
CVE-2020-26115

cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2020-26114

cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2020-26113

cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2020-26112

The email quota cache in cPanel before 90.0.10 allows overwriting of files.

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2020-26111

cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2020-26110

cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2020-26109

cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2020-26108

cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH
CVE-2020-26107

cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2020-26106

cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).

Published: September 25, 2020; 2:15:14 AM -0400 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM