Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

Arbitrary File Write as Root via Improper Link Resolution in cPanel

Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.

Unauthenticated Data Leakage in cPanel Calendar and Contact Access

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.

Arbitrary Perl Code Execution via Unvalidated Plugin Parameter in cPanel create_user

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

Arbitrary Command Execution via Multilang Adminbin Vulnerability

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Stored XSS Allowing Arbitrary Code Execution in WHM Mass Modify Accounts

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

Stored XSS in WHM Manage SSL Hosts Allows Remote Code Execution

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

Local User Access to Other Accounts' CalDAV and CardDAV Data via Permission Misassignment

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

Remote Code Execution via SQL Injection in cPanel EmailTrack Component

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

Potential Credential Exposure via HTTP Request Smuggling in cPanel

HTTP Smuggling in cPanel allows potential leak of credentials.

Privilege Escalation via SQL Mode Preservation During Database Rename

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.

Team Member Privilege Escalation to Team Owner in cPanel and WP Squared

Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

SQL Injection via sqloptimizer in cPanel when Slow Query logging is enabled

Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.