# cve.now: WebPros

The newest entries naming WebPros as an affected vendor (up to 200), of 51 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-107246](https://cve.now/CVE-2026-107246.md): The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. (CVSS 9.2)
- [CVE-2026-105476](https://cve.now/CVE-2026-105476.md): Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate… (CVSS 8.8)
- [CVE-2026-105475](https://cve.now/CVE-2026-105475.md): Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data. (CVSS 8.7)
- [CVE-2026-105474](https://cve.now/CVE-2026-105474.md): A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary c (CVSS 9.4)
- [CVE-2026-93699](https://cve.now/CVE-2026-93699.md): Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server. (CVSS 8.5)
- [CVE-2026-93029](https://cve.now/CVE-2026-93029.md): There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. (CVSS 9.0)
- [CVE-2026-93697](https://cve.now/CVE-2026-93697.md): There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. (CVSS 9.0)
- [CVE-2026-93698](https://cve.now/CVE-2026-93698.md): Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. (CVSS 9.9)
- [CVE-2026-87899](https://cve.now/CVE-2026-87899.md): Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. (CVSS 9.4)
- [CVE-2026-68492](https://cve.now/CVE-2026-68492.md): An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users (CVSS 8.7)
- [CVE-2026-68490](https://cve.now/CVE-2026-68490.md): Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts. (CVSS 8.2)
- [CVE-2026-87900](https://cve.now/CVE-2026-87900.md): Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute a (CVSS 9.4)
- [CVE-2026-87898](https://cve.now/CVE-2026-87898.md): OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. (CVSS 9.4)
- [CVE-2026-68491](https://cve.now/CVE-2026-68491.md): An insufficient check allowed for the overwrite of arbitrary files via a symlink. (CVSS 9.4)
- [CVE-2026-68489](https://cve.now/CVE-2026-68489.md): Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execut (CVSS 8.7)
- [CVE-2026-67399](https://cve.now/CVE-2026-67399.md): Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code. (CVSS 9.3)
- [CVE-2026-65639](https://cve.now/CVE-2026-65639.md): OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allo (CVSS 9.5)
- [CVE-2026-68487](https://cve.now/CVE-2026-68487.md): Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. (CVSS 9.9)
- [CVE-2026-65638](https://cve.now/CVE-2026-65638.md): Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary comma (CVSS 9.2)
- [CVE-2026-68488](https://cve.now/CVE-2026-68488.md): A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root (CVSS 9.9)
- [CVE-2026-67401](https://cve.now/CVE-2026-67401.md): A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component (CVSS 9.9)
- [CVE-2026-67397](https://cve.now/CVE-2026-67397.md): Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root. (CVSS 8.5)
- [CVE-2026-67402](https://cve.now/CVE-2026-67402.md): An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual ho (CVSS 9.2)
- [CVE-2026-67398](https://cve.now/CVE-2026-67398.md): Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9 (CVSS 8.2)
- [CVE-2026-65643](https://cve.now/CVE-2026-65643.md): Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root. (CVSS 8.7)
- [CVE-2026-67394](https://cve.now/CVE-2026-67394.md): A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions (CVSS 9.0)
- [CVE-2026-65646](https://cve.now/CVE-2026-65646.md): Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose ar (CVSS 9.9)
- [CVE-2026-65642](https://cve.now/CVE-2026-65642.md): Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and (CVSS 8.6)
- [CVE-2026-65647](https://cve.now/CVE-2026-65647.md): Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root. (CVSS 8.7)
- [CVE-2026-64639](https://cve.now/CVE-2026-64639.md): Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to (CVSS 9.3)
- [CVE-2026-64637](https://cve.now/CVE-2026-64637.md): Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative sessi (CVSS 9.9)
- [CVE-2026-64636](https://cve.now/CVE-2026-64636.md): An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data fro (CVSS 7.7)
- [CVE-2026-58048](https://cve.now/CVE-2026-58048.md): Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context. (CVSS 9.4)
- [CVE-2026-58047](https://cve.now/CVE-2026-58047.md): HTTP Smuggling in cPanel allows potential leak of credentials. (CVSS 5.6)
- [CVE-2026-58046](https://cve.now/CVE-2026-58046.md): Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitra (CVSS 9.9)
- [CVE-2026-56843](https://cve.now/CVE-2026-56843.md): Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domai (CVSS 9.9)
- [CVE-2026-48614](https://cve.now/CVE-2026-48614.md): An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resu (CVSS 9.9)
- [CVE-2026-47365](https://cve.now/CVE-2026-47365.md): Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cro (CVSS 9.9)
- [CVE-2026-44962](https://cve.now/CVE-2026-44962.md): Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolat (CVSS 9.9)
- [CVE-2026-32999](https://cve.now/CVE-2026-32999.md): Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute (CVSS 9.1)
- [CVE-2026-29206](https://cve.now/CVE-2026-29206.md): Insufficient sanitization of SQL queries in the \`sqloptimizer\` utility script allows SQL Injections on behalf of the root user if Slow Query (CVSS 8.1)
- [CVE-2026-32991](https://cve.now/CVE-2026-32991.md): Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account. (CVSS 7.1)
- [CVE-2026-29205](https://cve.now/CVE-2026-29205.md): Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment downloa (CVSS 8.6)
- [CVE-2026-32992](https://cve.now/CVE-2026-32992.md): SSL verification is disabled in the DNS Cluster system. (CVSS 8.2)
- [CVE-2026-32993](https://cve.now/CVE-2026-32993.md): Improper sanitization of the \`status\` query parameter of the \`/unprotected/nova\_error\` endpoint allows unauthenticated attacker to inject ar (CVSS 8.3)
- [CVE-2026-29204](https://cve.now/CVE-2026-29204.md): Insufficient ownership check in \`clientarea.php\` allows an authenticated client area user to submit requests using another user’s \`addonId\` (CVSS 9.1)
- [CVE-2026-29201](https://cve.now/CVE-2026-29201.md): Insufficient input validation of the feature file name in \`feature::LOADFEATUREFILE\` adminbin call can cause arbitrary file read when a rela (CVSS 8.6)
- [CVE-2026-29202](https://cve.now/CVE-2026-29202.md): Insufficient input validation of the \`plugin\` parameter of the \`create\_user\` plugin allows arbitrary Perl code execution on behalf of the al (CVSS 5.3)
- [CVE-2026-29203](https://cve.now/CVE-2026-29203.md): A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system fil (CVSS 5.3)
- [CVE-2026-29200](https://cve.now/CVE-2026-29200.md): A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. (CVSS 9.9)
- [CVE-2026-41940](https://cve.now/CVE-2026-41940.md): WebPros cPanel and WHM Authentication Bypass via Login Flow (CVSS 9.3, KEV)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/webpros
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.