Vendor
WebPros
51 known vulnerabilities.
WebPros at a glance
1 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 3 | 1 |
| Oct 2026 | 5 | 4 |
| Sep 2026 | 18 | 12 |
| Aug 2026 | 6 | 3 |
| Jul 2026 | 5 | 4 |
| Jun 2026 | 1 | 1 |
| May 2026 | 12 | 4 |
| Apr 2026 | 1 | 1 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
cPanel 20
Plesk 14
WP Squared 14
cPanel (CloudLinux 6, CentOS 6) 5
WHMCS 3
ConfigServer Security & Firewall 3
Plesk extension "Site Import" 2
Comet Backup 2
Plesk extension "Plesk RESTful API" 1
SolusVM 1
WP Toolkit 1
WordPress-Toolkit 1
SolusVM 2 1
WP Toolkit for cPanel 1
WHM 1
Plesk Migrator 1
Plesk Site Import 1
Plesk extension "Ruby" 1
Plesk extension "Node.js Toolkit" 1
51 results · Feed
-
Critical 9.2
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing pat…
-
High 8.7
Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact…
-
High 8.8
Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned f…
-
Critical 9.4
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users t…
-
High 8.5
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same …
-
Critical 9.0
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
-
Critical 9.0
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
-
Critical 9.9
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
-
High 8.2
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other ac…
-
High 8.7
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remot…
-
Critical 9.4
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrar…
-
Critical 9.4
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root p…
-
Critical 9.4
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
-
Critical 9.4
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
-
Critical 9.3
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execut…
-
High 8.7
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenti…
-
Critical 9.9
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
-
Critical 9.9
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privile…
-
Critical 9.2
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to exe…
-
Critical 9.5
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who contr…
-
Critical 9.9CVE-2026-67401 Public exploit
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailT…
-
High 8.5
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary cod…
-
High 8.2
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7…
-
Critical 9.2
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenge…
-
Critical 9.0
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, af…
-
High 8.7CVE-2026-65643 Public exploit
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
-
Critical 9.9
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated…
-
High 8.7CVE-2026-65647 Public exploit
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as …
-
High 8.6
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticat…
-
Critical 9.3
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (c…
-
Critical 9.9
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an…
-
High 7.7
An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to re…
-
Critical 9.4CVE-2026-58048 Public exploit
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
-
Medium 5.6
HTTP Smuggling in cPanel allows potential leak of credentials.
-
Critical 9.9
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injec…
-
Critical 9.9
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated cust…
-
Critical 9.9
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configura…
-
Critical 9.9
Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticate…
-
Critical 9.9
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplie…
-
Critical 9.1
Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant admi…