8.7Yüksek

CVE-2026-65643

WebPros cPanel Yayım: 2026-09-01 05:07 (2 ay önce)

Açıklama

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

Zayıflık türü (CWE): CWE-95

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
cpanel	cpanel	< 110.0.141
WebPros	cPanel	< 11.110.0.141, 11.112.0.0 – < 11.134.0.53, 11.136.0.0 – < 11.136.0.37, 11.138.0.0 – < 11.138.0.2, 11.138.1.0 – < 11.138.1.7

Kaynaklar ve yamalar

https://support.cpanel.net/hc/en-us/articles/42959571221527-Security-CVE-2026-65643-Park-API-Vulnerability-Au… Vendor Advisory

CPE eşleşmeleri (NVD) (5)

cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* < 110.0.141
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 112.0.0 < 134.0.53
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 136.0.0 < 136.0.37
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 138.0.0 < 138.0.2
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:* ≥ 138.1.0 < 138.1.7

CVSS puanı

8.7Yüksek

Kaynak: hackerone · CVSS 4.0

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Ön koşul: Yok
Gereken yetki: Düşük
Kullanıcı etkileşimi: Gerekmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tüm puanlar (3)

cna	CVSS 4.0	8.7Yüksek
support@hackerone.com	CVSS 4.0	8.7Yüksek
nvd	CVSS 3.1	8.8Yüksek

EPSS (30 günde istismar olasılığı)

0.88%

tüm CVE'lerin %59'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: poc
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2026-07-22
Yayımlandı2026-09-01 05:07
IP-DB'ye ulaştı2026-10-24 23:44
Son güncelleme2026-11-04 02:17

Numarayı veren (CNA): hackerone
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — cPanel & WHM

7.5Yüksek

CVE-2026-110688 19 gün önce

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse

Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse…

7.5Yüksek

CVE-2026-110687 19 gün önce

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp

Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, i…

6.5Orta

CVE-2026-110686 19 gün önce

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv

Cpanel-JSON-XS

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them…

9.1Kritik

CVE-2026-110685 19 gün önce

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag

Cpanel-JSON-XS

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are r…

8.1Yüksek

CVE-2026-110684 19 gün önce

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify

Cpanel-JSON-XS

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for obje…

7.5Yüksek

CVE-2026-110682 19 gün önce

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse

Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing del…