Hhestiacp

Products

Exploited and recent CVEs

• CVE-2026-111627 High 7.2 HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation 0.6%
• CVE-2026-108390 Critical 9.9 HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking 0.7%
• CVE-2025-30008 Medium 4.6 HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface 0.3%
• CVE-2025-30007 High 8.8 HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management 3.2%
• CVE-2026-12196 High 8.3 HestiaCP Admin Takeover 0.4%
• CVE-2026-43634 High 7.5 HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header 0.2%
• CVE-2026-43633 Critical 10.0 HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal 1.1%
• CVE-2023-5839 High 8.8 Privilege Chaining in hestiacp/hestiacp 0.3%
• CVE-2023-4517 Low 3.2 Cross-site Scripting (XSS) - Stored in hestiacp/hestiacp 0.5%
• CVE-2023-5084 Low 3.9 Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp 0.5%
• CVE-2023-3479 Medium 4.3 Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp 1.3%
• CVE-2022-2636 High 8.5 Code Injection in hestiacp/hestiacp 1.4%
• CVE-2022-2626 Critical 9.1 Incorrect Privilege Assignment in hestiacp/hestiacp 1.3%
• CVE-2022-2550 Critical 9.9 OS Command Injection in hestiacp/hestiacp 49.3%
• CVE-2022-1509 Critical 9.9 Command Injection Vulnerability in hestiacp/hestiacp 4.5%
• CVE-2022-0986 Low 2.4 Reflected Cross-site Scripting (XSS) Vulnerability in hestiacp/hestiacp 0.9%
• CVE-2022-0752 Low 3.5 Cross-site Scripting (XSS) - Generic in hestiacp/hestiacp 1.0%
• CVE-2022-0838 Medium 6.6 Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp 1.1%
• CVE-2022-0753 Low 3.5 Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp 0.8%
• CVE-2021-3797 Medium 4.8 Use of Wrong Operator in String Comparison in hestiacp/hestiacp 1.1%