WebPros vulnerabilities
51 CVEs and advisories name WebPros as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-107246The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal.
- CVE-2026-105476Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate…
- CVE-2026-105475Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.
- CVE-2026-105474A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary c
- CVE-2026-93699Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.
- CVE-2026-93029There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
- CVE-2026-93697There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
- CVE-2026-93698Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
- CVE-2026-87899Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
- CVE-2026-68492An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users
- CVE-2026-68490Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.
- CVE-2026-87900Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute a
- CVE-2026-87898OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
- CVE-2026-68491An insufficient check allowed for the overwrite of arbitrary files via a symlink.
- CVE-2026-68489Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execut
- CVE-2026-67399Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
- CVE-2026-65639OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allo
- CVE-2026-68487Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.
- CVE-2026-65638Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary comma
- CVE-2026-68488A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root
- CVE-2026-67401A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component
- CVE-2026-67397Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.
- CVE-2026-67402An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual ho
- CVE-2026-67398Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9
- CVE-2026-65643Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
- CVE-2026-67394A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions
- CVE-2026-65646Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose ar
- CVE-2026-65642Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and
- CVE-2026-65647Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.
- CVE-2026-64639Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to