hestiacp

20 results · Feed

• High 7.2
  CVE-2026-111627

  HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation

  HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/,…

  hestiacp hestiacp
  Oct 16, 2026
• Critical 9.9
  CVE-2026-108390

  HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

  Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, al…

  hestiacp hestiacp
  Oct 14, 2026
• Medium 4.6
  CVE-2025-30008

  HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface

  HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fai…

  hestiacp hestiacp
  Jul 10, 2026
• High 8.8
  CVE-2025-30007

  HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management

  HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can explo…

  hestiacp hestiacp
  Jul 10, 2026
• High 8.3
  CVE-2026-12196

  HestiaCP Admin Takeover

  HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administrator use…

  hestiacp hestiacp
  Jul 4, 2026
• High 7.5
  CVE-2026-43634

  HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header

  HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the r…

  hestiacp hestiacp
  May 19, 2026
• Critical 10.0
  CVE-2026-43633

  HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal

  HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attacker…

  hestiacp hestiacp
  May 19, 2026
• High 8.8
  CVE-2023-5839

  Privilege Chaining in hestiacp/hestiacp

  Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.

  hestiacp hestiacp/hestiacp
  Oct 29, 2023
• Low 3.2
  CVE-2023-4517

  Cross-site Scripting (XSS) - Stored in hestiacp/hestiacp

  Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.

  hestiacp hestiacp/hestiacp
  Oct 13, 2023
• Low 3.9
  CVE-2023-5084

  Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

  Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.

  hestiacp hestiacp/hestiacp
  Sep 20, 2023
• Medium 4.3
  CVE-2023-3479 Scanner template

  Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

  Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.

  hestiacp hestiacp/hestiacp
  Jun 30, 2023
• High 8.5
  CVE-2022-2636

  Code Injection in hestiacp/hestiacp

  Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.

  hestiacp hestiacp/hestiacp
  Aug 5, 2022
• Critical 9.1
  CVE-2022-2626

  Incorrect Privilege Assignment in hestiacp/hestiacp

  Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.

  hestiacp hestiacp/hestiacp
  Aug 5, 2022
• Critical 9.9
  CVE-2022-2550 EPSS 49%

  OS Command Injection in hestiacp/hestiacp

  OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.

  hestiacp hestiacp/hestiacp
  Jul 27, 2022
• Critical 9.9
  CVE-2022-1509

  Command Injection Vulnerability in hestiacp/hestiacp

  Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.

  hestiacp hestiacp/hestiacp
  Apr 28, 2022
• Low 2.4
  CVE-2022-0986

  Reflected Cross-site Scripting (XSS) Vulnerability in hestiacp/hestiacp

  Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.

  hestiacp hestiacp/hestiacp
  Mar 16, 2022
• Low 3.5
  CVE-2022-0752

  Cross-site Scripting (XSS) - Generic in hestiacp/hestiacp

  Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.

  hestiacp hestiacp/hestiacp
  Mar 4, 2022
• Medium 6.6
  CVE-2022-0838

  Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

  Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.

  hestiacp hestiacp/hestiacp
  Mar 4, 2022
• Low 3.5
  CVE-2022-0753

  Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

  Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.

  hestiacp hestiacp/hestiacp
  Mar 3, 2022
• Medium 4.8
  CVE-2021-3797

  Use of Wrong Operator in String Comparison in hestiacp/hestiacp

  hestiacp is vulnerable to Use of Wrong Operator in String Comparison

  hestiacp hestiacp/hestiacp
  Sep 15, 2021