cPanel 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには vendor risk input validation、パス処理の欠陥、vendor risk open redirect, and バッファオーバーフロー があり、vendor surface software deployment and vendor surface production workloads の利用場面で vendor impact session compromise、vendor impact unexpected behavior, and ファイル上書き などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2026-41940 KEV | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. | [email protected] | 9.3 | 90.54% | 2026-04-29 | 2026-05-04 |
| CVE-2025-66429 | An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user. | [email protected] | 8.8 | 0.71% | 2025-12-11 | 2025-12-15 |
| CVE-2023-29489 | An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. | [email protected] | 5.3 | 65.53% | 2023-04-27 | 2024-11-21 |
| CVE-2021-38590 | In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). | [email protected] | 5.5 | 0.26% | 2021-08-11 | 2024-11-21 |
| CVE-2021-38589 | In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). | [email protected] | 8.1 | 0.85% | 2021-08-11 | 2024-11-21 |
| CVE-2021-38588 | In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). | [email protected] | 8.1 | 0.44% | 2021-08-11 | 2024-11-21 |
| CVE-2021-38587 | In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). | [email protected] | 7.5 | 0.64% | 2021-08-11 | 2024-11-21 |
| CVE-2021-38586 | In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589). | [email protected] | 4.4 | 0.25% | 2021-08-11 | 2024-11-21 |
| CVE-2021-38585 | The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). | [email protected] | 7.2 | 1.03% | 2021-08-11 | 2024-11-21 |
| CVE-2021-38584 | The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). | [email protected] | 7.2 | 0.86% | 2021-08-11 | 2024-11-21 |
| CVE-2021-31803 | cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). | [email protected] | 6.1 | 0.58% | 2021-04-26 | 2024-11-21 |
| CVE-2021-26267 | cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579). | [email protected] | 7.5 | 0.92% | 2021-01-26 | 2024-11-21 |
| CVE-2021-26266 | cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578). | [email protected] | 7.5 | 0.92% | 2021-01-26 | 2024-11-21 |
| CVE-2020-29137 | cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577). | [email protected] | 6.1 | 0.63% | 2020-11-27 | 2024-11-21 |
| CVE-2020-29136 | In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). | [email protected] | 6.5 | 1.18% | 2020-11-27 | 2024-11-21 |
| CVE-2020-29135 | cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567). | [email protected] | 4.1 | 0.57% | 2020-11-27 | 2024-11-21 |
| CVE-2020-26115 | cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574). | [email protected] | 6.1 | 0.63% | 2020-09-25 | 2024-11-21 |
| CVE-2020-26114 | cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573). | [email protected] | 6.1 | 0.63% | 2020-09-25 | 2024-11-21 |
| CVE-2020-26113 | cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569). | [email protected] | 6.1 | 0.63% | 2020-09-25 | 2024-11-21 |
| CVE-2020-26112 | The email quota cache in cPanel before 90.0.10 allows overwriting of files. | [email protected] | 7.5 | 0.86% | 2020-09-25 | 2024-11-21 |