WebPros vulnerabilities
We track 32 vulnerabilities in WebPros products across 16 products. 32 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 12, 2026.
Latest WebPros vulnerabilities
- 8.4 High severity
Plesk: Incorrect Permission Assignment for Critical Resource
The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subscription information disclosure.
- 9.2 Critical severity
Plesk extension "Site Import": Improper Limitation of a Pathname to a Restricted Directory
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitr
- 9.4 Critical severity
SolusVM 2: Improper Neutralization of Special Elements Used in a Template Engine
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
- 9.4 Critical severity
WP Toolkit for cPanel: Improper Neutralization of Argument Delimiters in a Command
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.
- 8.7 High severity
Plesk: Untrusted Search Path
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
- 8.7 High severity
Plesk extension "Ruby": Improper Neutralization of Directives in Statically Saved Code
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
- 9.9 Critical severity
Plesk: Time-of-check Time-of-use (TOCTOU) Race Condition
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.
- 9.5 Critical severity
ConfigServer Security & Firewall: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulner
- 9.2 Critical severity
ConfigServer Security & Firewall: Improper Neutralization of Special Elements used in an OS Command
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally
- 9.2 Critical severity
ConfigServer Security & Firewall: Files or Directories Accessible to External Parties
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary command
- 8.2 High severity
WHMCS: Missing Authorization
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data v
- 9.0 Critical severity
Plesk: Improper Neutralization of Special Elements used in an OS Command
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allow
- 9.9 Critical severity
Plesk: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.
- 8.6 High severity
Plesk: Authorization Bypass Through User-Controlled Key
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases.
- 9.3 Critical severity
Plesk: Incorrect Privilege Assignment
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.
- 9.9 Critical severity
Plesk: Improper Privilege Management
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.
- 7.7 High severity
Plesk: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.
- 9.9 Critical severity
Plesk: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.
- 9.9 Critical severity
Plesk: Insufficiently Protected Credentials
Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for
- 9.9 Critical severity
Plesk: Improper Control of Generation of Code
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
- 9.9 Critical severity
WordPress-Toolkit: Improper Neutralization of Argument Delimiters in a Command
Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.
- 9.9 Critical severity
Plesk: Improper Neutralization of Data within XPath Expressions
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrar
- 9.0 Critical severity
Comet Backup: Improper Control of Generation of Code
Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.
- 8.1 High severity
cPanel: Improper Neutralization of Special Elements used in an SQL Command
Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.
- 8.3 High severity
cPanel: Improper Neutralization of CRLF Sequences
Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.
- 8.2 High severity
cPanel: Improper Certificate Validation
SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.
- 8.6 High severity
cPanel: Execution with Unnecessary Privileges
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
- 9.1 Critical severity
WHMCS: Authorization Bypass Through User-Controlled Key
Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any ownership validation leading to unauthorized access to the victim's account.
- 8.6 High severity
cPanel: Relative Path Traversal
Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.
- 9.9 Critical severity
Comet Backup: Authorization Bypass Through User-Controlled Key
A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to impersonate any end-user account of other tenants on the same server via a vulnerable
- 9.8 Critical severity
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Exploited
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
- 7.5 High severity
Red Hat OpenShift Dev Spaces: Uncontrolled Resource Consumption
Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_password.php endpoint, where a crafted request containing a malicious payload can cause the affected web interface to conti