CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 29/10/2023 |
| CVE-2023-4517 | MOYENNE5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6. | 13/10/2023 |
| CVE-2023-5084 | MOYENNE6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.
| 20/09/2023 |
| CVE-2023-3479 | MOYENNE6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8. | 30/06/2023 |
| CVE-2021-30071 | MOYENNE6.1 | A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | 18/08/2022 |
| CVE-2021-30070 | ÉLEVÉE7.5 | An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager. | 18/08/2022 |
| CVE-2022-2636 | ÉLEVÉE8.8 | Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6. | 05/08/2022 |
| CVE-2022-2626 | ÉLEVÉE7.2 | Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6. | 05/08/2022 |
| CVE-2022-2550 | ÉLEVÉE8.8 | OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5. | 27/07/2022 |
| CVE-2022-1509 | ÉLEVÉE8.8 | Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context. | 28/04/2022 |
| CVE-2022-0986 | MOYENNE6.1 | Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11. | 16/03/2022 |
| CVE-2022-0752 | MOYENNE6.1 | Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9. | 04/03/2022 |
| CVE-2022-0838 | MOYENNE6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10. | 04/03/2022 |
| CVE-2022-0753 | MOYENNE6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9. | 03/03/2022 |
| CVE-2021-3797 | CRITIQUE9.8 | hestiacp is vulnerable to Use of Wrong Operator in String Comparison | 15/09/2021 |
| CVE-2021-27231 | MOYENNE5.4 | Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages. | 16/02/2021 |
| CVE-2020-10966 | MOYENNE6.5 | In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name. | 25/03/2020 |