Skip to content
Threat Feed
Subscribe

Vendor

WebPros

5 briefs RSS
high advisory

Security Advisories for cPanel WHM and ConfigServer Security & Firewall

WebPros has released patches for multiple critical vulnerabilities in cPanel & WebHost Manager and ConfigServer Security & Firewall, including an SQL injection flaw in the EmailTrack component.

PoC cPanel & WebHost Manager +1 vulnerability web-application cpanel sql-injection
3c updated
medium advisory

Security Vulnerabilities in Plesk Management Interface and Extensions

WebPros has released security updates for Plesk and its Migrator and Site Import extensions to address critical vulnerabilities CVE-2026-65642 and CVE-2026-65647.

Plesk +2 vulnerability patch-management web-hosting
2c
high advisory

Blind SQL Injection Vulnerability in Plesk Obsidian

Plesk Obsidian versions prior to 18.0.80.1 and 18.0.79.5 are vulnerable to a blind SQL injection (CVE-2026-64636) which allows unauthenticated or low-privileged attackers to execute unauthorized database queries.

Plesk Obsidian vulnerability sql-injection web-application
1t 1c
high advisory

Blind SQL Injection Vulnerability in Plesk XML-RPC API

A blind SQL injection vulnerability, tracked as CVE-2026-58046, affects the Plesk XML-RPC API, potentially allowing unauthenticated attackers to execute arbitrary database queries.

Plesk web-application sql-injection vulnerability
1r 1t 1c
critical advisory

WebPros cPanel & WHM and WP2 Authentication Bypass Vulnerability (CVE-2026-41940)

CVE-2026-41940 is an authentication bypass vulnerability in WebPros cPanel & WHM and WP2 (WordPress Squared) that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

cPanel & WHM +1 cpanel whm wp2 wordpress authentication-bypass cve-2026-41940 initial-access
2r 1t 1c