cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVSS
9.3
CRITICAL
Published
Apr 29, 2026
Loading
Vendor coverage
Track published CVEs, severity trends, and remediation context for cpanel products.
Search results
Showing 1-50 of 50 vulnerabilities.
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVSS
9.3
CRITICAL
Published
Apr 29, 2026
An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user.
CVSS
8.8
HIGH
Published
Dec 11, 2025
An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.
CVSS
5.3
MEDIUM
Published
Apr 27, 2023
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
CVSS
5.5
MEDIUM
Published
Aug 11, 2021
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588).
CVSS
8.1
HIGH
Published
Aug 11, 2021
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
CVSS
8.1
HIGH
Published
Aug 11, 2021
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
CVSS
7.5
HIGH
Published
Aug 11, 2021
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).
CVSS
4.4
MEDIUM
Published
Aug 11, 2021
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
CVSS
7.2
HIGH
Published
Aug 11, 2021
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
CVSS
7.2
HIGH
Published
Aug 11, 2021
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
CVSS
6.1
MEDIUM
Published
Apr 26, 2021
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
CVSS
7.5
HIGH
Published
Jan 26, 2021
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
CVSS
7.5
HIGH
Published
Jan 26, 2021
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
CVSS
6.1
MEDIUM
Published
Nov 27, 2020
In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).
CVSS
6.5
MEDIUM
Published
Nov 27, 2020
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).
CVSS
4.1
MEDIUM
Published
Nov 27, 2020
cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).
CVSS
6.1
MEDIUM
Published
Sep 25, 2020
cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).
CVSS
6.1
MEDIUM
Published
Sep 25, 2020
cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).
CVSS
6.1
MEDIUM
Published
Sep 25, 2020
The email quota cache in cPanel before 90.0.10 allows overwriting of files.
CVSS
7.5
HIGH
Published
Sep 25, 2020
cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).
CVSS
6.1
MEDIUM
Published
Sep 25, 2020
cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).
CVSS
6.1
MEDIUM
Published
Sep 25, 2020
cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557).
CVSS
7.5
HIGH
Published
Sep 25, 2020
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).
CVSS
9.8
CRITICAL
Published
Sep 25, 2020
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).
CVSS
7.5
HIGH
Published
Sep 25, 2020
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).
CVSS
7.5
HIGH
Published
Sep 25, 2020
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).
CVSS
9.8
CRITICAL
Published
Sep 25, 2020
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
CVSS
7.5
HIGH
Published
Sep 25, 2020
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
CVSS
7.5
HIGH
Published
Sep 25, 2020
In cPanel before 88.0.3, an insecure auth policy API key is used by Dovecot on a templated VM (SEC-550).
CVSS
7.5
HIGH
Published
Sep 25, 2020
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549).
CVSS
9.8
CRITICAL
Published
Sep 25, 2020
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497).
CVSS
9.8
CRITICAL
Published
Sep 25, 2020
cPanel before 88.0.3 allows attackers to bypass the SMTP greylisting protection mechanism (SEC-491).
CVSS
7.5
HIGH
Published
Sep 25, 2020
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485).
CVSS
9.8
CRITICAL
Published
Sep 25, 2020
cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).
CVSS
8.1
HIGH
Published
May 11, 2020
cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).
CVSS
5.3
MEDIUM
Published
May 11, 2020
cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).
CVSS
6.5
MEDIUM
Published
Mar 17, 2020
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).
CVSS
9.8
CRITICAL
Published
Mar 17, 2020
cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).
CVSS
7.2
HIGH
Published
Mar 17, 2020
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).
CVSS
9.8
CRITICAL
Published
Mar 17, 2020
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
CVSS
9.1
CRITICAL
Published
Mar 17, 2020
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).
CVSS
9.1
CRITICAL
Published
Mar 17, 2020
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).
CVSS
5.3
MEDIUM
Published
Mar 17, 2020
cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537).
CVSS
7.2
HIGH
Published
Mar 17, 2020
cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).
CVSS
6.1
MEDIUM
Published
Mar 17, 2020
cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).
CVSS
6.1
MEDIUM
Published
Mar 17, 2020
cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).
CVSS
9.8
CRITICAL
Published
Mar 17, 2020
cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).
CVSS
5.4
MEDIUM
Published
Mar 17, 2020
cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).
CVSS
5.5
MEDIUM
Published
Mar 17, 2020
cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).
CVSS
6.5
MEDIUM
Published
Mar 17, 2020