← Back

Cpanel

cpanel

429 CVEs • 6 products

Products (6)

Click to collapse
Toggle
Cpanel
cpanel
420 CVEs
Webhost Manager
webhost_manager
5 CVEs
Whm
whm
5 CVEs
Cgiecho
cgiecho
3 CVEs
Cgiemail
cgiemail
3 CVEs
Wp Squared
wp_squared
3 CVEs

CVEs (429)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2004-1604
1Cpanel
1Cpanel
Apr 16, 2026
Sep 30, 2004
N/A· v4
N/A· v3
5.0 MEDIUM· v2
cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the _private directory, which is created when Front Page extensions are enabled.
CVE-2004-0490
1Cpanel
1Cpanel
Apr 16, 2026
Aug 18, 2004
N/A· v4
N/A· v3
7.2 HIGH· v2
cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the...Show more
cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the PATH_TRANSLATED variable, which allows local users to execute arbitrary PHP code as other users via a URL that references the attacker's script after the user's script, which executes the attacker's script with the user's privileges, a different vulnerability than CVE-2004-0529.Show less
CVE-2004-1875
1Cpanel
1Cpanel
Apr 16, 2026
Mar 30, 2004
N/A· v4
N/A· v3
9.3 HIGH· v2
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3)...Show more
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to ignorelist.html, (5) account parameter to showlog.html, (6) db parameter to repairdb.html, (7) login parameter to doaddftp.html (8) account parameter to editmsg.htm, or (9) ip parameter to del.html. NOTE: the dnslook.html vector was later reported to exist in cPanel 10.Show less
CVE-2004-1849
1Cpanel
1Cpanel
Apr 16, 2026
Mar 24, 2004
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to dodelautores.html or (2) handle parameter to addhandle.html...Show more
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to dodelautores.html or (2) handle parameter to addhandle.html.Show less
CVE-2004-1770
1Cpanel
1Cpanel
Apr 16, 2026
Mar 11, 2004
N/A· v4
N/A· v3
10.0 HIGH· v2
The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via shell metacharacters in the user parameter.
CVE-2004-1769
1Cpanel
1Cpanel
Apr 16, 2026
Mar 11, 2004
N/A· v4
N/A· v3
10.0 HIGH· v2
The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.
CVE-2003-1426
1Cpanel
1Cpanel
Apr 16, 2026
Dec 31, 2003
N/A· v4
N/A· v3
3.3 LOW· v2
Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to execute arbitrary code by modifying SCRIPT_FIL...Show more
Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to execute arbitrary code by modifying SCRIPT_FILENAME to reference a directory containing a malicious openwebmail-shared.pl executable.Show less
CVE-2003-1425
1Cpanel
1Cpanel
Apr 16, 2026
Dec 31, 2003
N/A· v4
N/A· v3
10.0 HIGH· v2
guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.
CVE-2003-0521
1Cpanel
1Cpanel
Apr 16, 2026
Aug 18, 2003
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when...Show more
Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the (1) Error Log or (2) Latest Visitors screens.Show less