Threats affecting pkg:composer/whmcs/whmcs

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.3	EPSS 0.8%	CVE-2026-67399WebPros WHMCS · Deserialization of Untrusted Data Critical9.3EPSS 0.8%2026-09-14CVE Database V5CVE-2026-67399 Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code. EPSS 0.8%Vulnerability CWE-502	CVE Database V5	2026-09-14
Critical	9.1	EPSS 0.3%	CVE-2026-29204WebPros WHMCS · Insecure Direct Object Reference (IDOR) Critical9.1EPSS 0.3%2026-05-12CVE Database V5CVE-2026-29204 CVE-2026-29204 is a critical vulnerability in WebPros WHMCS affecting versions 7.4.0, 18.13.0, and 9.0.0. It involves an insecure direct object reference (IDOR) due to insufficient ownership checks in the clientarea.php component. An authenticated user can submit requests using another user's addonId without proper validation, potentially gaining unauthorized access to the victim's account. EPSS 0.3%Vulnerability CWE-639	CVE Database V5	2026-05-12

Page 1 of 1