Advisories · Technology
hestiacp.
Every CVE that names hestiacp among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation
- hestiacp
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking
- hestiacp
- Command injection
- Code injection
- CVSS 5.1 Medium
HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface
- hestiacp
- Cross-site scripting (XSS)
- CVSS 8.7 High
HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management
- hestiacp
- Command injection
- CVSS 8.3 High
HestiaCP Admin Takeover
- hestiacp
- Authentication bypass
- CVSS 8.7 High
HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header
- hestiacp
- CWE-348
- CVSS 9.5 CriticalCritical · CVSS 9+
HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal
- hestiacp
- Insecure deserialization