Webpros
44 CVEs across 20 Webpros products. Browse Webpros vulnerabilities, severities, and proof-of-concept exploits.
Webpros products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-87900 | | 2026-09-23 | Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code acros… | |
CVE-2026-87899 | | 2026-09-23 | Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. | |
CVE-2026-87898 | | 2026-09-23 | OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. | |
CVE-2026-68492 | | 2026-09-23 | An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitra… | |
CVE-2026-68490 | | 2026-09-23 | Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts. | |
CVE-2026-68491 | | 2026-09-15 | An insufficient check allowed for the overwrite of arbitrary files via a symlink. | |
CVE-2026-68489 | | 2026-09-14 | Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as… | |
CVE-2026-67399 | | 2026-09-14 | Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code. | |
CVE-2026-68488 | Critical | 9.9 | 2026-09-10 | A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file… |
CVE-2026-68487 | Critical | 9.9 | 2026-09-10 | Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. |
CVE-2026-65639 | | 2026-09-10 | OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to exec… | |
CVE-2026-65638 | | 2026-09-10 | Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF serv… | |
CVE-2026-67401 | Critical | 9.9 | 2026-09-09 | A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component |
CVE-2026-67402 | | 2026-09-04 | An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauth… | |
CVE-2026-67398 | | 2026-09-04 | Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL… | |
CVE-2026-67397 | | 2026-09-04 | Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root. | |
CVE-2026-67394 | | 2026-09-01 | A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before… | |
CVE-2026-65643 | High | 8.8 | 2026-09-01 | Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root. |
CVE-2026-65647 | | 2026-08-26 | Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root. | |
CVE-2026-65646 | Critical | 9.9 | 2026-08-26 | Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files… |
CVE-2026-65642 | | 2026-08-26 | Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other custom… | |
CVE-2026-64639 | | 2026-08-12 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary… | |
CVE-2026-64637 | Critical | 9.9 | 2026-08-07 | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root use… |
CVE-2026-64636 | High | 7.7 | 2026-08-07 | An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel databas… |
CVE-2026-58048 | | 2026-07-31 | Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context. | |
CVE-2026-58047 | | 2026-07-31 | HTTP Smuggling in cPanel allows potential leak of credentials. | |
CVE-2026-58046 | Critical | 9.9 | 2026-07-30 | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Pl… |
CVE-2026-56843 | Critical | 9.9 | 2026-07-08 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own… |
CVE-2026-48614 | Critical | 9.9 | 2026-07-06 | An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary… |
CVE-2026-47365 | Critical | 9.9 | 2026-06-12 | Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authoriza… |
CVE-2026-44962 | Critical | 9.9 | 2026-05-29 | Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queri… |
CVE-2026-32999 | Critical | 9.0 | 2026-05-28 | Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code o… |
CVE-2026-32991 | High | 7.1 | 2026-05-13 | Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account. |
CVE-2026-29206 | High | 8.1 | 2026-05-13 | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled. |
CVE-2026-32993 | High | 8.3 | 2026-05-13 | Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header… |
CVE-2026-32992 | High | 8.2 | 2026-05-13 | SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials. |
CVE-2026-29205 | High | 8.6 | 2026-05-13 | Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints. |
CVE-2026-29204 | Critical | 9.1 | 2026-05-12 | Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownersh… |
CVE-2026-29203 | High | 8.8 | 2026-05-08 | A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories… |
CVE-2026-29202 | High | 8.8 | 2026-05-08 | Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated… |
CVE-2026-29201 | High | 8.6 | 2026-05-08 | Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is p… |
CVE-2026-29200 | | 2026-05-04 | A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant a… | |
CVE-2026-41940 | Critical | 9.8 | 2026-04-29 | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unaut… |
CVE-2025-65518 | High | 7.5 | 2026-01-08 | Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_password.php endpoint… |