CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 29/10/2023 |
| CVE-2023-4517 | 보통5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6. | 13/10/2023 |
| CVE-2023-5084 | 보통6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.8.8.
| 20/09/2023 |
| CVE-2023-3479 | 보통6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8. | 30/06/2023 |
| CVE-2021-30071 | 보통6.1 | A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | 18/08/2022 |
| CVE-2021-30070 | 높음7.5 | An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager. | 18/08/2022 |
| CVE-2022-2636 | 높음8.8 | Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6. | 05/08/2022 |
| CVE-2022-2626 | 높음7.2 | Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6. | 05/08/2022 |
| CVE-2022-2550 | 높음8.8 | OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5. | 27/07/2022 |
| CVE-2022-1509 | 높음8.8 | Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context. | 28/04/2022 |
| CVE-2022-0986 | 보통6.1 | Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11. | 16/03/2022 |
| CVE-2022-0752 | 보통6.1 | Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9. | 04/03/2022 |
| CVE-2022-0838 | 보통6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10. | 04/03/2022 |
| CVE-2022-0753 | 보통6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9. | 03/03/2022 |
| CVE-2021-3797 | 심각9.8 | hestiacp is vulnerable to Use of Wrong Operator in String Comparison | 15/09/2021 |
| CVE-2021-27231 | 보통5.4 | Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages. | 16/02/2021 |
| CVE-2020-10966 | 보통6.5 | In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name. | 25/03/2020 |