An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.
CVSS Score
8.8
EPSS Score
0.001
Published
2025-12-11
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.
CVSS Score
5.3
EPSS Score
0.929
Published
2023-04-27
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
CVSS Score
7.2
EPSS Score
0.006
Published
2021-08-11
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
CVSS Score
7.2
EPSS Score
0.015
Published
2021-08-11
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).
CVSS Score
4.4
EPSS Score
0.001
Published
2021-08-11
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
CVSS Score
7.5
EPSS Score
0.003
Published
2021-08-11
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
CVSS Score
8.1
EPSS Score
0.002
Published
2021-08-11
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).
CVSS Score
8.1
EPSS Score
0.006
Published
2021-08-11
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
CVSS Score
5.5
EPSS Score
0.0
Published
2021-08-11
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
CVSS Score
6.1
EPSS Score
0.004
Published
2021-04-26
Page 1