Vulnerabilities in Webpros
50 resultsCVE-2026-48614CRITICALAn improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resuEPSS 0.6%CVE-2026-58046CRITICALImproper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitraEPSS 0.6%CVE-2026-58048CRITICALImproper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.EPSS 0.6%CVE-2026-64639CRITICALIncorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) toEPSS 0.6%CVE-2026-93029CRITICALThere is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.EPSS 0.5%CVE-2026-93697CRITICALThere is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.EPSS 0.5%CVE-2026-67402CRITICALAn insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual hoEPSS 0.5%CVE-2026-105476HIGHImproper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate priEPSS 0.5%CVE-2026-58047MEDIUMHTTP Smuggling in cPanel allows potential leak of credentials.EPSS 0.5%CVE-2026-29203MEDIUMA chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system filEPSS 0.5%CVE-2026-105474CRITICALA server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary cEPSS 0.5%CVE-2026-65642HIGHInsecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and EPSS 0.5%CVE-2026-67398HIGHMissing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9EPSS 0.5%CVE-2026-64637CRITICALImproper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative sessiEPSS 0.5%CVE-2026-68491CRITICALAn insufficient check allowed for the overwrite of arbitrary files via a symlink.EPSS 0.5%CVE-2026-29201HIGHInsufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relaEPSS 0.4%CVE-2026-47365CRITICALArgument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass croEPSS 0.4%CVE-2026-64636HIGHAn SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data froEPSS 0.4%CVE-2026-105475HIGHImproper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.EPSS 0.4%CVE-2026-68488CRITICALA Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to rootEPSS 0.4%