Hestiacp: >> Control Panel >> 0.9.8-28 Security Vulnerabilities
HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in list_dns_rec.php, allowing the payload to execute in the browser of any user who views the DNS record list, including administrators.
CVSS Score
5.1
EPSS Score
0.002
Published
2026-07-10
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.
CVSS Score
8.7
EPSS Score
0.02
Published
2026-07-10
Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.
CVSS Score
8.8
EPSS Score
0.003
Published
2023-10-29
Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8.
CVSS Score
4.3
EPSS Score
0.013
Published
2023-06-30
A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score
6.1
EPSS Score
0.005
Published
2022-08-18
Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.
CVSS Score
8.5
EPSS Score
0.011
Published
2022-08-05
Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.
CVSS Score
9.1
EPSS Score
0.011
Published
2022-08-05
OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.
CVSS Score
9.9
EPSS Score
0.475
Published
2022-07-27
Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.
CVSS Score
9.9
EPSS Score
0.046
Published
2022-04-28
Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.
CVSS Score
2.4
EPSS Score
0.009
Published
2022-03-16
Page 1