Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

488 results · page 9 of 10

Jul 30, 2019cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).CVE-2019-14406 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).CVE-2019-14405 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484).CVE-2019-14404 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).CVE-2019-14403 · Websites & servers · Cpanel · reported by MITREMedium 4.3
cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).CVE-2019-14402 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).CVE-2019-14401 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).CVE-2019-14400 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).CVE-2019-14399 · Websites & servers · Cpanel · reported by MITREHigh 7.1
The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).CVE-2019-14398 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).CVE-2019-14397 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).CVE-2019-14396 · Websites & servers · Cpanel · reported by MITRELow 3.3
API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).CVE-2019-14395 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).CVE-2019-14394 · Websites & servers · Cpanel · reported by MITREMedium 5.5
cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).CVE-2019-14393 · Websites & servers · Cpanel · reported by MITREMedium 5.3
cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).CVE-2018-20870 · Websites & servers · Cpanel · reported by MITREMedium 5.5
The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).CVE-2018-20869 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).CVE-2018-20868 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).CVE-2018-20866 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).CVE-2018-20865 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).CVE-2018-20864 · Websites & servers · Cpanel · reported by MITREMedium 6.5
cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).CVE-2018-20863 · Websites & servers · Cpanel · reported by MITRECritical 9.8
cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).CVE-2018-20862 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).CVE-2019-14392 · Websites & servers · Cpanel · reported by MITREHigh 8.8
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).CVE-2018-20867 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).CVE-2019-14391 · Websites & servers · Cpanel · reported by MITRELow 3.3
cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).CVE-2019-14390 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).CVE-2019-14389 · Websites & servers · Cpanel · reported by MITREHigh 7.8
cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).CVE-2019-14388 · Websites & servers · Cpanel · reported by MITREHigh 7.5
cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).CVE-2019-14387 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Jul 30, 2019cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).CVE-2019-14386 · Websites & servers · Cpanel · reported by MITREMedium 5.4
cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.cpanel.net documentation.cpanel.net
Aug 30, 2018cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/indCVE-2018-16236 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com cxsecurity.com
Jul 19, 2017The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66CVE-2017-11441 · Websites & servers · Cpanel · reported by MITREMedium 5.4
The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66.0.2 has XSS via a locale filename, aka SEC-297.
Product
WHM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record news.cpanel.com news.cpanel.com
Mar 3, 2017Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the addendum parameter.CVE-2017-5616 · Websites & servers · Cpanel · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the addendum parameter.
Product
Cgiecho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 3, 2017cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.CVE-2017-5615 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.
Product
Cgiecho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 3, 2017Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors inCVE-2017-5614 · Websites & servers · Cpanel · reported by MITREMedium 6.1
Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Mar 3, 2017Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.CVE-2017-5613 · Websites & servers · Cpanel · reported by MITREHigh 7.8
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.
Product
Cgiecho
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
May 12, 2015The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion ofCVE-2015-2845 · Other software · Goautodial · reported by MITREHigh 10
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion of the PATH_INFO.
Product
Goadmin CE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record goautodial.org packetstormsecurity.com
May 12, 2015The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion CVE-2015-2844 · Other software · Goautodial · reported by MITREHigh 10
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATH_INFO.
Product
Goadmin CE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record goautodial.org packetstormsecurity.com
Apr 27, 2010Cross-site scripting (XSS) vulnerability in frontend/x3/files/fileop.html in cPanel 11.0 through 11.24.7 allows remote attackers to inject arbitrary web script CVE-2009-4823 · Websites & servers · Cpanel · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in frontend/x3/files/fileop.html in cPanel 11.0 through 11.24.7 allows remote attackers to inject arbitrary web script or HTML via the fileop parameter.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Sep 1, 2009Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers to list arbitrary dirCVE-2008-7142 · Websites & servers · Cpanel · reported by MITREMedium 5
Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers to list arbitrary directories via the showtree parameter.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityfocus.com
Aug 10, 2009Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers tCVE-2008-6927 · Websites & servers · Cpanel · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary web script or HTML via the (1) localapp, (2) updatedir, (3) scriptpath_show, (4) domain_show, (5) thispage, (6) thisapp, and (7) currentversion parameters in an Upgrade action.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com netenberg.com
Aug 10, 2009Directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allows remote attackers to include and exeCVE-2008-6926 · Other software · Netenberg · reported by MITREMedium 6.8
Directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the scriptpath_show parameter in a GoAhead action. NOTE: this issue only crosses privilege boundaries when security settings such as disable_functions and safe_mode are active, since exploitation requires uploading of executable code to a home directory.
Product
Fantastico DE Luxe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record netenberg.com securityfocus.com
Jul 2, 2009Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a ..CVE-2008-6843 · Other software · Netenberg · reported by MITREMedium 5
Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a .. (dot dot) in the sup3r parameter.
Product
Fantastico DE Luxe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
Jul 1, 2009Directory traversal vulnerability in frontend/x3/stats/lastvisit.html in cPanel allows remote attackers to read arbitrary files via a ..CVE-2009-2275 · Websites & servers · Cpanel · reported by MITREMedium 5
Directory traversal vulnerability in frontend/x3/stats/lastvisit.html in cPanel allows remote attackers to read arbitrary files via a .. (dot dot) in the domain parameter.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Jun 22, 2009cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied credentials are incorrectCVE-2009-2168 · Other software · Egyplus · reported by MITRECritical 9.8
cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied credentials are incorrect, which allows remote attackers to bypass authentication by providing arbitrary username and password parameters.
Product
7ammel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Jun 22, 2009Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quotes_gpc is disabled, allow remote attackCVE-2009-2167 · Other software · Egyplus · reported by MITREMedium 6.8
Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.
Product
7ammel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vupen.com exchange.xforce.ibmcloud.com
Sep 23, 2008Directory traversal vulnerability in includes/xml.php in the Netenberg Fantastico De Luxe module before 2.10.4 r19 for cPanel, when cPanel PHP Register Globals CVE-2008-4181 · Other software · Netenberg · reported by MITREMedium 6.8
Directory traversal vulnerability in includes/xml.php in the Netenberg Fantastico De Luxe module before 2.10.4 r19 for cPanel, when cPanel PHP Register Globals is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) or absolute pathname in the fantasticopath parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
Product
Fantastico DE Luxe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
May 28, 2008scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitCVE-2008-2478 · Websites & servers · Cpanel · reported by MITREHigh 8.5
scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this, stating "I'm unable to reproduce such an issue on multiple servers running different versions of cPanel.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
May 12, 2008Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote atCVE-2008-2071 · Websites & servers · Cpanel · reported by MITREMedium 4.3
Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote attackers to perform unauthorized actions as cPanel administrators via requests to cpanel/whm/webmail and other unspecified vectors.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record changelog.cpanel.net lists.grok.org.uk
May 12, 2008The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script CVE-2008-2070 · Websites & servers · Cpanel · reported by MITREMedium 4.3
The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the (1) issue parameter to scripts2/knowlegebase, (2) user parameter to scripts2/changeip, (3) search parameter to scripts2/listaccts, and other unspecified vectors.
Product
Cpanel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record changelog.cpanel.net lists.grok.org.uk

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.