Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 25

Export CSV
CVE-2026-111627

HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Hestiacp
CVE-2026-108390

HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Hestiacp
CVE-2025-30007

HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.

CVSS 4.0 · 8.7 High EPSS 3.2% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel Hestiacp
CVE-2025-30008

HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface

HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in list_dns_rec.php, allowing the payload to execute in the browser of any user who views the DNS record list, including administrators.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel Hestiacp
CVE-2026-12196

HestiaCP Admin Takeover

HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administrator users in the application and the underlying webserver.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Hestiacp
CVE-2026-43634

HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header

HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Hestiacp
CVE-2026-43633

HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal

HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.

CVSS 4.0 · 9.5 Critical EPSS 1.1% KEV · Not listed
Vendors
Hestiacp
Products
Hestiacp
CVE-2021-47871

Hestia Control Panel 1.3.2 - Arbitrary File Write

Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the API index.php endpoint. Attackers can exploit the v-make-tmp-file command to write SSH keys or other content to specific file paths on the server.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel
CVE-2022-2636

Code Injection in hestiacp/hestiacp

Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.

CVSS 3.1 · 8.5 High EPSS 1.4% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel
CVE-2023-5084

Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Hestiacp
CVE-2023-5839

Privilege Chaining in hestiacp/hestiacp

Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel
CVE-2023-4517

Cross-site Scripting (XSS) - Stored in hestiacp/hestiacp

Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Hestiacp
CVE-2023-3479

Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.

CVSS 3.1 · 6.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel Hestiacp
CVE-2022-2626

Incorrect Privilege Assignment in hestiacp/hestiacp

Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel
CVE-2022-2550

OS Command Injection in hestiacp/hestiacp

OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.

CVSS 3.1 · 8.8 High EPSS 49.3% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel
CVE-2022-1509

Command Injection Vulnerability in hestiacp/hestiacp

Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.

CVSS 3.1 · 9.9 Critical EPSS 4.5% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel
CVE-2022-0986

Reflected Cross-site Scripting (XSS) Vulnerability in hestiacp/hestiacp

Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel
CVE-2022-0838

Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.

CVSS 3.1 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel
CVE-2022-0753

Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel
CVE-2022-0752

Cross-site Scripting (XSS) - Generic in hestiacp/hestiacp

Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Control Panel