Veille CVE

Recherche « WebPros WP Squared »

14 CVE

Critique 5 Élevée 8 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WebPros WP Squared » ✕
  1. CVE-2026-93698 9.9 Critique

    Webpros cPanel · Webpros WP Squared

    Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

  2. CVE-2026-93697 9.0 Critique

    Webpros cPanel · Webpros WP Squared

    There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

  3. CVE-2026-93029 9.0 Critique

    Webpros cPanel · Webpros WP Squared

    There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

  4. CVE-2026-58048 9.4 Critique

    WebPros cPanel · WebPros WP Squared

    Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

  5. CVE-2026-58047 5.6 Moyenne

    WebPros cPanel · WebPros WP Squared

    HTTP Smuggling in cPanel allows potential leak of credentials.

  6. CVE-2026-32991 7.1 Élevée

    WebPros cPanel · WebPros WP Squared · WebPros cPanel (CloudLinux 6, CentOS 6)

    Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

  7. CVE-2026-29206 8.1 Élevée

    WebPros cPanel · WebPros WP Squared · WebPros cPanel (CloudLinux 6, CentOS 6)

    Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

  8. CVE-2026-32993 8.3 Élevée

    WebPros cPanel · WebPros WP Squared

    Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.

  9. CVE-2026-32992 8.2 Élevée

    WebPros cPanel · WebPros WP Squared · Cpanel cpanel · Cpanel wp squared

    SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

  10. CVE-2026-29205 8.6 Élevée

    WebPros cPanel · WebPros WP Squared · Cpanel cpanel · Cpanel wp squared

    Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

  11. CVE-2026-29203 8.8 Élevée

    WebPros cPanel · WebPros cPanel (CloudLinux 6, CentOS 6) · WebPros WP Squared

    A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.

  12. CVE-2026-29202 8.8 Élevée

    WebPros cPanel · WebPros cPanel (CloudLinux 6, CentOS 6) · WebPros WP Squared

    Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

  13. CVE-2026-29201 8.6 Élevée

    WebPros cPanel · WebPros WP Squared · WebPros cPanel (CloudLinux 6, CentOS 6)

    Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

  14. CVE-2026-41940 9.8 Critique Exploitée Rançongiciel

    WebPros cPanel · WebPros WP Squared · WebPros WHM · Cpanel cpanel

    cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.