WebPros vulnerabilities

CVE-2026-105474 Critical · 9.4 CWE-1336 Oct 15, 2026

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that…

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.

CVE-2026-93699 High · 8.5 CWE-88 Oct 8, 2026

Argument Injection in WebPros WP Toolkit

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

CVE-2026-65643 High · 8.8 CWE-95 Sep 1, 2026

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute...

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

CVE-2026-47365 Critical · 9.9 CWE-88 Jun 12, 2026

Argument Injection in WebPros WordPress-Toolkit

Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

CVE-2026-44962 Critical · 9.9 CWE-643 May 29, 2026

Plesk contains an XPath injection vulnerability in the APS Application Catalog search…

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

CVE-2026-32999 Critical · 9.0 CWE-94 May 28, 2026

Code Injection in WebPros Comet Backup

Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.

CVE-2026-32991 High · 7.1 CWE-863 May 13, 2026

Incorrect Authorization in WebPros cPanel

Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

CVE-2026-29206 High · 8.1 CWE-89 May 13, 2026

SQL Injection in WebPros cPanel

Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

CVE-2026-32993 High · 8.3 CWE-93 May 13, 2026

Improper sanitization of the `status` query parameter of the `/unprotected/nova_error`…

Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.

CVE-2026-32992 High · 8.2 CWE-295 May 13, 2026

Improper Certificate Validation in Cpanel

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

CVE-2026-29205 High · 8.6 CWE-250 May 13, 2026

Execution with Unnecessary Privileges in Cpanel

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

CVE-2026-29204 Critical · 9.1 CWE-639 May 12, 2026

WHMCS Authorization Bypass via addonId in Client Area

Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation leading to unauthorized access to the victim's account.

CVE-2026-29203 High · 8.8 CWE-61 May 8, 2026

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks…

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.

CVE-2026-29202 High · 8.8 CWE-94 May 8, 2026

Code Injection in WebPros cPanel

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

CVE-2026-29201 High · 8.6 CWE-23 May 8, 2026

Relative Path Traversal in WebPros cPanel

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

CVE-2026-29200 Critical · 9.9 CWE-639 May 4, 2026

WebPros Comet Backup IDOR Enables Cross-Tenant User Impersonation

A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to impersonate any end-user account of other tenants on the same server via a vulnerable API call.

CVE-2026-41940 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-306 Apr 29, 2026

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CVE-2025-65518 High · 7.5 CWE-400 Jan 8, 2026

Uncontrolled Resource Consumption in Webpros Plesk Obsidian

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_password.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service unavailable to legitimate users. An attacker can exploit this issue remotely without authentication, resulting in a persistent availability impact on the affected Plesk Obsidian instance.