rz1027 (rz1027)

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.