« Volver al listado

CVE-2026-93697

Estado: AplazadaCrítica (9)—

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS almacenado (CWE-79) en interfaz web permite inyectar código JavaScript malicioso (T1189). El atacante autenticado (PR:L) puede ejecutar scripts en navegador (T1059.007) y potencialmente secuestrar sesiones/cuentas (T1078) en WHM.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingRestrict Web-Based ContentApplication Developer GuidanceActive Directory ConfigurationUser Account ManagementPrivileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Cpanel — WHMAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93697",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-93697",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-02T18:12:58.690897Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "support@hackerone.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "Webpros",
          "product": "cPanel",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "11.138.0.11",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "11.136.0.45",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "11.134.0.61",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "11.110.0.148",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Webpros",
          "product": "WP Squared",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "11.138.1.13",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-02T07:16:38.893",
  "references": [
    {
      "url": "https://docs.cpanel.net/changelogs/110-change-log/#1100148",
      "source": "support@hackerone.com"
    },
    {
      "url": "https://docs.cpanel.net/changelogs/134-change-log/#134061",
      "source": "support@hackerone.com"
    },
    {
      "url": "https://docs.cpanel.net/changelogs/136-change-log/#136045",
      "source": "support@hackerone.com"
    },
    {
      "url": "https://docs.cpanel.net/changelogs/138-change-log/#138011",
      "source": "support@hackerone.com"
    },
    {
      "url": "https://docs.wpsquared.com/changelogs/versions/changelog/#138113",
      "source": "support@hackerone.com"
    },
    {
      "url": "https://hackerone.com/reports/4047787",
      "source": "support@hackerone.com"
    },
    {
      "url": "https://support.cpanel.net/hc/en-us/articles/43845930445207-Security-CVE-2026-93697-Stored-XSS-in-WHM-s-Account-Modification-Interfaces-September-29-2026",
      "source": "support@hackerone.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface."
    }
  ],
  "lastModified": "2026-10-02T19:16:42.790",
  "sourceIdentifier": "support@hackerone.com"
}