Veille CVE

Recherche « Cpanel whm »

8 CVE

Critique 6 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Cpanel whm » ✕
  1. CVE-2026-104586 9.8 Critique

    AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.

  2. CVE-2026-93697 9.0 Critique

    Webpros cPanel · Webpros WP Squared

    There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

  3. CVE-2026-93029 9.0 Critique

    Webpros cPanel · Webpros WP Squared

    There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

  4. CVE-2026-87886 7.8 Élevée Exploitée

    Acronis Backup plugin for cPanel & WHM · Acronis Backup extension for Plesk · Acronis Backup plugin for DirectAdmin · Acronis acronis backup

    Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

  5. CVE-2026-54420 8.5 Élevée Exploitée

    LiteSpeed Technologies cPanel Plugin · Litespeedtech litespeed cpanel plugin · Litespeedtech litespeed whm plugin

    LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

  6. CVE-2026-47365 9.9 Critique

    WebPros WordPress-Toolkit

    Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

  7. CVE-2026-48172 9.8 Critique Exploitée

    LiteSpeed Technologies cPanel Plugin · LiteSpeed Technologies WHM Plugin · Litespeedtech litespeed cpanel plugin · Litespeedtech litespeed whm plugin

    LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

  8. CVE-2026-41940 9.8 Critique Exploitée Rançongiciel

    WebPros cPanel · WebPros WP Squared · WebPros WHM · Cpanel cpanel

    cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.