Threat database

CVE-2026-105474 is a critical server-side template injection vulnerability in WebPros SolusVM 2 up to version 2.0.0-44576. It allows remote authenticated users to execute arbitrary code with root privileges on the affected system. The vulnerability stems from improper neutralization of special elements used in the template engine. The CVSS 4.0 base score is 9.4, indicating a high severity with network attack vector, low attack complexity, and no user interaction required.

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

CVE-2026-68491 is a critical vulnerability in Webpros SolusVM where improper link resolution before file access allows an attacker with limited privileges to overwrite arbitrary files via symbolic links. This flaw affects SolusVM versions from 0 up to but not including 1.30.15. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact potential. No official patch or remediation details are provided in the input data.

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.

CVE-2026-67401 is a critical SQL Injection vulnerability in WebPros cPanel's EmailTrack component. It allows a mail-enabled account to achieve remote code execution as root. The vulnerability affects multiple versions of cPanel prior to specific patch versions. The CVSS score is 9.9, indicating a severe impact on confidentiality, integrity, and availability.

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.