Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: perlPackages.CpanelJSONXS

Found 14 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-29202
8.8 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 3 months, 3 weeks ago Activity log
  • Created suggestion 3 months, 3 weeks ago
Insufficient input validation of the `plugin` parameter of the `create_user` …

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

Affected products

cPanel
  • <11.102.0.41
  • <11.134.0.25
  • <11.86.0.43
  • <11.132.0.31
  • <11.118.0.66
  • <11.110.0.117
  • <11.124.0.37
  • <11.94.0.30
  • <11.130.0.22
  • <11.136.0.9
  • <11.110.0.116
  • <11.126.0.58
WP Sqaured
  • <11.136.1.10
cPanel (CentOS 6, CloudLinux 6)
  • <11.110.0.114

Matching in nixpkgs

Untriaged
Permalink CVE-2026-29201
4.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 3 months, 3 weeks ago Activity log
  • Created suggestion 3 months, 3 weeks ago
Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` …

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

Affected products

cPanel
  • <11.102.0.41
  • <11.134.0.25
  • <11.86.0.43
  • <11.132.0.31
  • <11.118.0.66
  • <11.110.0.117
  • <11.124.0.37
  • <11.94.0.30
  • <11.130.0.22
  • <11.136.0.9
  • <11.110.0.116
  • <11.126.0.58
WP Squared
  • <11.136.1.10
cPanel (CentOS 6, CloudLinux 6)
  • <11.110.0.114

Matching in nixpkgs

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-41940
9.8 CRITICAL
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 4 months ago by @LeSuisse Activity log
  • Created suggestion 4 months ago
  • @LeSuisse dismissed (not in Nixpkgs) 4 months ago
cPanel and WHM Authentication Bypass via Login Flow

cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

Affected products

WHM
  • <11.118.0.63
  • <11.136.0.5
  • <11.126.0.54
  • <11.110.0.97
  • <11.132.0.29
  • <11.134.0.20
cPanel
  • <11.118.0.63
  • <11.136.0.5
  • <11.126.0.54
  • <11.110.0.97
  • <11.132.0.29
  • <11.134.0.20
WP Squared
  • <11.136.1.7

Matching in nixpkgs

Published
Permalink CVE-2025-40929
5.6 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 10 months ago by @LeSuisse Activity log
  • Created suggestion 11 months, 1 week ago
  • @LeSuisse accepted 10 months ago
  • @LeSuisse published on GitHub 10 months ago
Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Affected products

Cpanel-JSON-XS
  • <4.40

Matching in nixpkgs