Cpanel vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2022-48623 The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a deniCritical 9.1 · Feb 13, 2024
• CVE-2021-38589 In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).High 8.1 · Aug 11, 2021
• CVE-2021-38588 In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).High 8.1 · Aug 11, 2021
• CVE-2021-38587 In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).High 7.5 · Aug 11, 2021
• CVE-2021-38585 The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).High 7.2 · Aug 11, 2021
• CVE-2021-38584 The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).High 7.2 · Aug 11, 2021
• CVE-2021-26267 cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).High 7.5 · Jan 26, 2021
• CVE-2021-26266 cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).High 7.5 · Jan 26, 2021
• CVE-2020-26112 The email quota cache in cPanel before 90.0.10 allows overwriting of files.High 7.5 · Sep 25, 2020
• CVE-2020-26109 cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).High 7.5 · Sep 25, 2020
• CVE-2020-26108 cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).Critical 9.8 · Sep 25, 2020
• CVE-2020-26107 cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).High 7.5 · Sep 25, 2020
• CVE-2020-26106 cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).High 7.5 · Sep 25, 2020
• CVE-2020-26105 In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).Critical 9.8 · Sep 25, 2020
• CVE-2020-26104 In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).High 7.5 · Sep 25, 2020
• CVE-2020-26103 In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).High 7.5 · Sep 25, 2020
• CVE-2020-26102 In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).High 7.5 · Sep 25, 2020
• CVE-2020-26101 In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).Critical 9.8 · Sep 25, 2020
• CVE-2020-26100 chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).Critical 9.8 · Sep 25, 2020
• CVE-2020-26099 cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).High 7.5 · Sep 25, 2020
• CVE-2020-26098 cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).Critical 9.8 · Sep 25, 2020
• CVE-2020-12785 cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).High 8.1 · May 11, 2020
• CVE-2020-10121 cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).Critical 9.8 · Mar 17, 2020
• CVE-2020-10120 cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).High 7.2 · Mar 17, 2020
• CVE-2020-10119 cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).Critical 9.8 · Mar 17, 2020