Vendor
WebPros
51 known vulnerabilities.
Products
cPanel 20
Plesk 14
WP Squared 14
cPanel (CloudLinux 6, CentOS 6) 5
WHMCS 3
ConfigServer Security & Firewall 3
Plesk extension "Site Import" 2
Comet Backup 2
Plesk extension "Plesk RESTful API" 1
SolusVM 1
WP Toolkit 1
WordPress-Toolkit 1
SolusVM 2 1
WP Toolkit for cPanel 1
WHM 1
Plesk Migrator 1
Plesk Site Import 1
Plesk extension "Ruby" 1
Plesk extension "Node.js Toolkit" 1
30 results · Clear filters · Feed
-
Critical 9.2
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing pat…
-
Critical 9.4
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users t…
-
Critical 9.0
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
-
Critical 9.0
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
-
Critical 9.9
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
-
Critical 9.4
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrar…
-
Critical 9.4
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root p…
-
Critical 9.4
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
-
Critical 9.4
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
-
Critical 9.3
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execut…
-
Critical 9.9
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
-
Critical 9.9
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privile…
-
Critical 9.2
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to exe…
-
Critical 9.5
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who contr…
-
Critical 9.9CVE-2026-67401 Public exploit
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailT…
-
Critical 9.2
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenge…
-
Critical 9.0
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, af…
-
Critical 9.9
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated…
-
Critical 9.3
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (c…
-
Critical 9.9
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an…
-
Critical 9.4CVE-2026-58048 Public exploit
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
-
Critical 9.9
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injec…
-
Critical 9.9
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated cust…
-
Critical 9.9
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configura…
-
Critical 9.9
Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticate…
-
Critical 9.9
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplie…
-
Critical 9.1
Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant admi…
-
Critical 9.1CVE-2026-29204 Public exploit
Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using anot…
-
Critical 9.9
A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.…
-
Critical 9.8
WebPros cPanel and WHM Authentication Bypass via Login Flow
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
KEV Apr 30, 2026