CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 29/10/2023 |
| CVE-2023-3479 | 中危6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.7.8. | 30/06/2023 |
| CVE-2021-30071 | 中危6.1 | A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | 18/08/2022 |
| CVE-2022-2636 | 高危8.8 | Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6. | 05/08/2022 |
| CVE-2022-2626 | 高危7.2 | Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6. | 05/08/2022 |
| CVE-2022-2550 | 高危8.8 | OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5. | 27/07/2022 |
| CVE-2022-1509 | 高危8.8 | Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context. | 28/04/2022 |
| CVE-2022-0986 | 中危6.1 | Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11. | 16/03/2022 |
| CVE-2022-0752 | 中危6.1 | Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9. | 04/03/2022 |
| CVE-2022-0838 | 中危6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10. | 04/03/2022 |
| CVE-2022-0753 | 中危6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9. | 03/03/2022 |
| CVE-2021-3797 | 严重9.8 | hestiacp is vulnerable to Use of Wrong Operator in String Comparison | 15/09/2021 |
| CVE-2021-27231 | 中危5.4 | Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages. | 16/02/2021 |
| CVE-2020-10966 | 中危6.5 | In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name. | 25/03/2020 |