Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Oct 16, 2026HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the CVE-2026-111627 · Other software · hestiacp · reported by VulnCheckHigh 8.6
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.
- Product
- hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Hestia Control Panel is a lightweight and powerful control panel for the modern web.CVE-2026-108390 · Other software · hestiacp · reported by GitHubCritical 9.9
Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.
- Product
- hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a CVE-2025-30008 · Other software · hestiacp · reported by VulnCheckMedium 5.1
HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in list_dns_rec.php, allowing the payload to execute in the browser of any user who views the DNS record list, including administrators.
- Product
- hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands aCVE-2025-30007 · Other software · hestiacp · reported by VulnCheckHigh 8.7
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.
- Product
- hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2026HestiaCP panel cronjob feature is affected by a broken access control vulnerability.CVE-2026-12196 · Other software · hestiacp · reported by ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4aHigh 8.3
HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administrator users in the application and the underlying webserver.
- Product
- hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprojectblack.io
May 19, 2026HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controCVE-2026-43634 · Other software · hestiacp · reported by VulnCheckHigh 8.7
HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request.
- Product
- hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and CVE-2026-43633 · Other software · hestiacp · reported by VulnCheckCritical 9.5
HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.
- Product
- hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2023Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.CVE-2023-5839 · Other software · hestiacp · reported by security@huntr.devHigh 7.8
Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2023Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.CVE-2023-4517 · Other software · hestiacp · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.CVE-2023-5084 · Other software · hestiacp · reported by security@huntr.devLow 3.9
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.CVE-2023-3479 · Other software · hestiacp · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2021-30071 · Other software · Hestiacp · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022An issue was discovered in HestiaCP before v1.3.5.CVE-2021-30070 · Other software · Hestiacp · reported by MITREHigh 7.5
An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager.
- Product
- Hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.CVE-2022-2636 · Other software · hestiacp · reported by security@huntr.devHigh 8.5
Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.CVE-2022-2626 · Other software · hestiacp · reported by security@huntr.devHigh 7.2
Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2022OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.CVE-2022-2550 · Other software · hestiacp · reported by security@huntr.devHigh 8.8
OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12.CVE-2022-1509 · Other software · hestiacp · reported by security@huntr.devCritical 9.9
Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.CVE-2022-0986 · Other software · hestiacp · reported by security@huntr.devMedium 6.1
Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2022Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.CVE-2022-0752 · Other software · hestiacp · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.CVE-2022-0838 · Other software · hestiacp · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.CVE-2022-0753 · Other software · hestiacp · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021hestiacp is vulnerable to Use of Wrong Operator in String ComparisonCVE-2021-3797 · Other software · hestiacp · reported by security@huntr.devCritical 9.8
hestiacp is vulnerable to Use of Wrong Operator in String Comparison
- Product
- hestiacp/hestiacp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2021Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customeCVE-2021-27231 · Other software · Hestiacp · reported by MITREMedium 5.4
Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages.
- Product
- Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2020In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover bCVE-2020-10966 · Other software · Hestiacp · reported by MITREMedium 6.5
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.
- Product
- Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.