Threat Intelligence Database

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

CVE-2026-32991 is a high-severity vulnerability in WebPros cPanel versions 11.110.0.0 through 11.136.0.0. It involves improper authorization checks that allow a team member to escalate their privileges to that of the team owner. The vulnerability has a CVSS 3.1 score of 7.

CVE-2026-29205 is a high-severity vulnerability in WebPros cPanel affecting multiple versions. It involves incorrect privilege management and insufficient path filtering in the cpdavd attachment download endpoints, allowing an attacker to read arbitrary files on the server without authentication. The vulnerability has a CVSS score of 8.6, indicating a significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-32992 is a high-severity vulnerability in WebPros cPanel affecting multiple versions where SSL verification is disabled in the DNS Cluster system. This improper certificate validation (CWE-295) could allow a malicious server to perform a man-in-the-middle attack and capture credentials. There is no official patch or remediation level currently provided by the vendor. The vulnerability has not been reported as exploited in the wild.

CVE-2026-32993 is a high-severity vulnerability in WebPros cPanel versions 11.132.0.0, 11.134.0.0, and 11.136.0.0.

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.