Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by WebPros
CVE-2026-41940 (GCVE-0-2026-41940)
Vulnerability from cvelistv5 – Published: 2026-04-29 15:10 – Updated: 2026-05-01 03:55
VLAI?
Title
WebPros cPanel and WHM Authentication Bypass via Login Flow
Summary
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
Severity ?
9.8 (Critical)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WebPros | cPanel |
Affected:
11.40.0.0 , < 11.86.0.41
(custom)
Affected: 11.88.0.0 , < 11.110.0.97 (custom) Affected: 11.112.0.0 , < 11.118.0.63 (custom) Affected: 11.120.0.0 , < 11.126.0.54 (custom) Affected: 11.128.0.0 , < 11.130.0.19 (custom) Affected: 11.132.0.0 , < 11.132.0.29 (custom) Affected: 11.134.0.0 , < 11.134.0.20 (custom) Affected: 11.136.0.0 , < 11.136.0.5 (custom) |
||||||||||||
|
||||||||||||||
Date Public ?
2026-04-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41940",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-04-30",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T03:55:47.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41940"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-30T00:00:00.000Z",
"value": "CVE-2026-41940 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "cPanel",
"vendor": "WebPros",
"versions": [
{
"lessThan": "11.86.0.41",
"status": "affected",
"version": "11.40.0.0",
"versionType": "custom"
},
{
"lessThan": "11.110.0.97",
"status": "affected",
"version": "11.88.0.0",
"versionType": "custom"
},
{
"lessThan": "11.118.0.63",
"status": "affected",
"version": "11.112.0.0",
"versionType": "custom"
},
{
"lessThan": "11.126.0.54",
"status": "affected",
"version": "11.120.0.0",
"versionType": "custom"
},
{
"lessThan": "11.130.0.19",
"status": "affected",
"version": "11.128.0.0",
"versionType": "custom"
},
{
"lessThan": "11.132.0.29",
"status": "affected",
"version": "11.132.0.0",
"versionType": "custom"
},
{
"lessThan": "11.134.0.20",
"status": "affected",
"version": "11.134.0.0",
"versionType": "custom"
},
{
"lessThan": "11.136.0.5",
"status": "affected",
"version": "11.136.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "WP Squared",
"vendor": "WebPros",
"versions": [
{
"status": "unaffected",
"version": "11.136.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "WHM",
"vendor": "WebPros",
"versions": [
{
"lessThan": "11.86.0.41",
"status": "affected",
"version": "11.40.0.0",
"versionType": "custom"
},
{
"lessThan": "11.110.0.97",
"status": "affected",
"version": "11.88.0.0",
"versionType": "custom"
},
{
"lessThan": "11.118.0.63",
"status": "affected",
"version": "11.112.0.0",
"versionType": "custom"
},
{
"lessThan": "11.126.0.54",
"status": "affected",
"version": "11.120.0.0",
"versionType": "custom"
},
{
"lessThan": "11.130.0.19",
"status": "affected",
"version": "11.128.0.0",
"versionType": "custom"
},
{
"lessThan": "11.132.0.29",
"status": "affected",
"version": "11.132.0.0",
"versionType": "custom"
},
{
"lessThan": "11.134.0.20",
"status": "affected",
"version": "11.134.0.0",
"versionType": "custom"
},
{
"lessThan": "11.136.0.5",
"status": "affected",
"version": "11.136.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.110.0.97",
"versionStartIncluding": "11.110.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.118.0.63",
"versionStartIncluding": "11.118.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.126.0.54",
"versionStartIncluding": "11.126.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.132.0.29",
"versionStartIncluding": "11.132.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.134.0.20",
"versionStartIncluding": "11.134.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.136.0.5",
"versionStartIncluding": "11.136.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.86.0.41",
"versionStartIncluding": "11.86.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.130.0.18",
"versionStartIncluding": "11.130.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.110.0.97",
"versionStartIncluding": "11.110.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.118.0.63",
"versionStartIncluding": "11.118.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.126.0.54",
"versionStartIncluding": "11.126.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.132.0.29",
"versionStartIncluding": "11.132.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.134.0.20",
"versionStartIncluding": "11.134.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.136.0.5",
"versionStartIncluding": "11.136.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.130.0",
"versionStartIncluding": "11.86.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cpanel:whm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.130.0.18",
"versionStartIncluding": "11.130.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cpanel:wp_squared:*:*:*:*:*:*:*:*",
"versionEndExcluding": "136.1.7",
"versionStartIncluding": "136.1.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"datePublic": "2026-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T17:32:32.294Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026"
},
{
"tags": [
"release-notes"
],
"url": "https://docs.cpanel.net/release-notes/release-notes"
},
{
"tags": [
"release-notes"
],
"url": "https://docs.wpsquared.com/changelogs/versions/changelog/#13617"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cpanel-and-whm-authentication-bypass-via-login-flow"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WebPros cPanel and WHM Authentication Bypass via Login Flow",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-41940",
"datePublished": "2026-04-29T15:10:37.899Z",
"dateReserved": "2026-04-22T18:50:43.621Z",
"dateUpdated": "2026-05-01T03:55:47.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-65518 (GCVE-0-2025-65518)
Vulnerability from cvelistv5 – Published: 2026-01-08 00:00 – Updated: 2026-01-08 19:05
VLAI?
Summary
Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_password.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service unavailable to legitimate users. An attacker can exploit this issue remotely without authentication, resulting in a persistent availability impact on the affected Plesk Obsidian instance.
Severity ?
7.5 (High)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-65518",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-08T19:03:33.008970Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-08T19:05:27.934Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_password.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to continuously reload, rendering the service unavailable to legitimate users. An attacker can exploit this issue remotely without authentication, resulting in a persistent availability impact on the affected Plesk Obsidian instance."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-08T18:34:02.894Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://plesk.com"
},
{
"url": "https://github.com/Jainil-89/CVE-2025-65518/blob/main/cve.md"
},
{
"url": "https://docs.plesk.com/release-notes/obsidian/change-log/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-65518",
"datePublished": "2026-01-08T00:00:00.000Z",
"dateReserved": "2025-11-18T00:00:00.000Z",
"dateUpdated": "2026-01-08T19:05:27.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}