Known vulnerabilities in Hestia Control Panel

Software CPE: cpe:2.3:a:hestia_control_panel:hestia_control_panel:*:*:*:*:*:*:*:*
Total vulnerabilities: 18
Public exploits: 1
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Hestia Control Panel Hestia Control Panel is affected by 18 known vulnerabilities: 3 high, 10 medium, 5 low Critical High Medium Low

Vulnerabilities (18)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU140987 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
1.9.9 05.08.2026 SB2026080551
#VU140564 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-80 Low
No
No
1.9.8 30.07.2026 SB2026073068
#VU140563 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 Medium
No
No
1.9.8 30.07.2026 SB2026073068
#VU140562 - Improper Authorization
CWE-285 Low
No
No
1.9.8 30.07.2026 SB2026073068
#VU140561 - Interpretation Conflict
CWE-436 High
No
No
1.9.6 30.07.2026 SB2026073067
#VU140560 - Use of Less Trusted Source
CWE-348 High
No
No
1.9.4 30.07.2026 SB2026073066
#VU140559 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
1.9.5 30.07.2026 SB2026073065
#VU140558 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 Medium
No
No
1.9.5 30.07.2026 SB2026073065
#VU140557 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 Medium
No
No
1.9.5 30.07.2026 SB2026073065
#VU140556 - Eval Injection
CWE-95 Medium
No
No
1.9.5 30.07.2026 SB2026073065
#VU140555 - Improper Authorization
CWE-285 Medium
No
No
1.9.7 30.07.2026 SB2026073064
#VU140554 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Medium
No
No
1.9.7 30.07.2026 SB2026073064
#VU140553 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
1.9.7 30.07.2026 SB2026073064
#VU81728 - Resource exhaustion
CVE-2023-44487
CWE-400 High
Available
Exploited
1.8.9 10.10.2023 SB2023101023
SB2023101024
SB2023101037
and 650 more
#VU66179 - Incorrect Privilege Assignment
CVE-2022-2626
CWE-266 Low
No
No
1.6.6 08.08.2022 SB2022080817
#VU66178 - Improper input validation
CVE-2022-2636
CWE-20 Medium
No
No
1.6.6 08.08.2022 SB2022080817
#VU61050 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-0838
CWE-79 Low
No
No
1.5.10 07.03.2022 SB2022030710
#VU50803 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2021-27231
CWE-451 Medium
No
No
1.4.0 18.02.2021 SB2021021812