Cpanel: >> Cpanel >> 58.0.49 Security Vulnerabilities
CVE-2026-41940
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Known exploited
CVSS Score
9.3
EPSS Score
0.284
Published
2026-04-29
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
CVSS Score
7.2
EPSS Score
0.006
Published
2021-08-11
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
CVSS Score
7.2
EPSS Score
0.015
Published
2021-08-11
In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).
CVSS Score
7.5
EPSS Score
0.003
Published
2021-08-11
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
CVSS Score
8.1
EPSS Score
0.002
Published
2021-08-11
cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).
CVSS Score
6.1
EPSS Score
0.004
Published
2021-04-26
cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
CVSS Score
7.5
EPSS Score
0.003
Published
2021-01-26
cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
CVSS Score
7.5
EPSS Score
0.003
Published
2021-01-26
cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
CVSS Score
6.1
EPSS Score
0.004
Published
2020-11-27
cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).
CVSS Score
4.1
EPSS Score
0.002
Published
2020-11-27
Page 1