Vendor
WebPros
456 known vulnerabilities in products by WebPros, 1 of them actively exploited (CISA KEV).
Key figures
456
Vulnerabilities
1
Actively exploited (KEV)
1
Used by ransomware
29
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2026-41940 | WebPros cPanel and WHM Authentication Bypass via Login Flow In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2020-26098 | WebPros cPanel: Remote Code Execution | 9.8 | |
| High | CVE-2006-5014 | WebPros cPanel: Privilege Escalation | 8.8 | |
| Medium | CVE-2023-29489 | WebPros cPanel: Cross-Site Scripting (XSS) | 5.3 | |
| Critical | CVE-2016-10855 | WebPros cPanel: Code Execution | 9.8 | |
| Critical | CVE-2016-10824 | WebPros cPanel: Code Execution | 9.8 | |
| Critical | CVE-2016-10858 | WebPros cPanel: Code Execution | 9.8 | |
| Critical | CVE-2020-26108 | WebPros cPanel: Code Execution | 9.8 | |
| Critical | CVE-2018-20863 | WebPros cPanel: Code Execution | 9.8 | |
| Critical | CVE-2026-67401 | WebPros cPanel: SQL Injection | 9.9 | |
| Critical | CVE-2020-10119 | WebPros cPanel: Remote Code Execution | 9.8 | |
| High | CVE-2024-7348 | PostgreSQL relation replacement during pg_dump executes arbitrary SQL | 8.8 | |
| High | CVE-2016-10828 | WebPros cPanel: Code Execution | 8.8 | |
| Critical | CVE-2026-93698 | Webpros cPanel: OS Command Injection | 9.9 | |
| Critical | CVE-2020-10121 | WebPros cPanel: Code Execution | 9.8 | |
| Critical | CVE-2024-11235 | Reference counting in php_request_shutdown causes Use-After-Free | 8.1 | |
| High | CVE-2026-65643 | WebPros cPanel: Eval Injection | 8.8 | |
| High | CVE-2017-5613 | WebPros Cgiecho: Format String | 7.8 | |
| High | CVE-2016-10850 | WebPros cPanel: Code Execution | 8.8 | |
| High | CVE-2016-10823 | WebPros cPanel: Code Execution | 8.8 | |
| High | CVE-2016-10840 | WebPros cPanel: Code Execution | 8.8 | |
| Critical | CVE-2016-10817 | WebPros cPanel: SQL Injection | 9.8 | |
| High | CVE-2020-10120 | WebPros cPanel: Remote Code Execution | 7.2 | |
| Critical | CVE-2020-26100 | WebPros cPanel: security vulnerability | 9.8 | |
| Critical | CVE-2019-20498 | WebPros cPanel: Authentication Bypass | 9.8 |
News
- Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Serverthehackernews,
- New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Rootthehackernews,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 25sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 23sans-atrisk-mail,
Products
| Product | CVEs | Actively exploited |
|---|---|---|
| WebPros cPanel | 420 | 1 |
| Cpanel/whm | 28 | 0 |
| cPanel WHM (WebHost Manager) | 5 | 1 |
| Cpanel/whm Wp2 | 5 | 0 |
| Webhost Manager | 5 | 0 |
| Cgiecho | 3 | 0 |
| Cgiemail | 3 | 0 |
| cPanel WP Squared | 3 | 1 |