Known vulnerabilities in Hestia Control Panel

Software CPE: cpe:2.3:a:hestia_control_panel:hestia_control_panel:*:*:*:*:*:*:*:*
Total vulnerabilities: 23
Public exploits: 1
Known exploited (KEV): 1

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Hestia Control Panel Hestia Control Panel is affected by 23 known vulnerabilities: 3 high, 11 medium, 9 low Critical High Medium Low

Vulnerabilities (23)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU150162 - Incorrect Authorization
CWE-863 Low
No
No
1.10.5 16.09.2026 SB2026091615
#VU150161 - Uncontrolled Search Path Element
CWE-427 Medium
No
No
1.10.5 16.09.2026 SB2026091615
#VU150160 - Incorrect Authorization
CWE-863 Low
No
No
1.10.5 16.09.2026 SB2026091615
#VU150159 - Not Failing Securely (\'Failing Open\')
CWE-636 Low
No
No
1.10.5 16.09.2026 SB2026091615
#VU146001 - Authorization Bypass Through User-Controlled Key
CWE-639 Low
No
No
1.9.10, 1.10.4 27.08.2026 SB20260827145
#VU140987 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
1.9.9 05.08.2026 SB2026080551
#VU140564 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-80 Low
No
No
1.9.8 30.07.2026 SB2026073068
#VU140563 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 Medium
No
No
1.9.8 30.07.2026 SB2026073068
#VU140562 - Improper Authorization
CWE-285 Low
No
No
1.9.8 30.07.2026 SB2026073068
#VU140561 - Interpretation Conflict
CWE-436 High
No
No
1.9.6 30.07.2026 SB2026073067
#VU140560 - Use of Less Trusted Source
CWE-348 High
No
No
1.9.4 30.07.2026 SB2026073066
#VU140559 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
1.9.5 30.07.2026 SB2026073065
#VU140558 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 Medium
No
No
1.9.5 30.07.2026 SB2026073065
#VU140557 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 Medium
No
No
1.9.5 30.07.2026 SB2026073065
#VU140556 - Eval Injection
CWE-95 Medium
No
No
1.9.5 30.07.2026 SB2026073065
#VU140555 - Improper Authorization
CWE-285 Medium
No
No
1.9.7 30.07.2026 SB2026073064
#VU140554 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Medium
No
No
1.9.7 30.07.2026 SB2026073064
#VU140553 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
1.9.7 30.07.2026 SB2026073064
#VU81728 - Resource exhaustion
CVE-2023-44487
CWE-400 High
Available
Exploited
1.8.9 10.10.2023 SB2023101023
SB2023101024
SB2023101037
and 652 more
#VU66178 - Improper input validation
CVE-2022-2636
CWE-20 Medium
No
No
1.6.6 08.08.2022 SB2022080817


Showing elements 1 - 20 out of 23