cPanel ErrorPage Webcall ID 反射型XSS漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:XSS:CPANEL-WEBCALL-XSS.html
• https://www.assetnote.io/resources/research/finding-xss-in-a-million-websites-cpanel-cve-2023-29489
• https://www.sentinelone.com/vulnerability-database/cve-2023-29489/
• https://nvd.nist.gov/vuln/detail/CVE-2023-29489
• https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=34157
• https://zhuanlan.zhihu.com/p/626716196
• https://soc.cyber.wa.gov.au/advisories/20230510003-cPanel-Exploit-Vulnerability/
• https://hackerone.com/reports/1982630
• https://pentest-tools.com/vulnerabilities-exploits/cpanel-111099999116-cross-site-scripting_2593
• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-29489.yaml
• https://forums.cpanel.net/threads/cpanel-tsr-2023-0001-full-disclosure.708949/

Related Vulnerabilities

• PoCccm-detect: Clear-Com Core Configuration Manager Panel - Detect
• PoCctrlpanel-installer: CtrlPanel Installer Exposure
• PoCopcache-control-panel: Opcache control Panel - Unauthenticated Access
• PoCcpanel-mailman-xss: cPanel Mailman - Cross-Site Scripting
• PoCCVE-2026-41940: cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
• PoCcPanel & WHM 权限绕过漏洞（CVE-2026-41940）
• PoCCVE-2024-13055: Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting
• 飞致云 1Panel 未授权 设计缺陷漏洞
• 飞致云 1Panel 身份验证缺陷漏洞
• dpanel /api/common/user/login 默认口令漏洞
• dpanel /api/app/compose/get-from-uri 文件读取漏洞（CVE-2025-53363）