CVE-2004-1769

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 34.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-03-11 · updated 2026-06-16

Description

The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.

Affected products

WebPros cPanel: 5.0, 5.3, 6.0, 6.2, 6.4, 6.4.1 (+6)

References

http://marc.info/?l=bugtraq&m=107904890724201&w=2
http://secunia.com/advisories/11111
http://www.kb.cert.org/vuls/id/831534
http://www.securityfocus.com/archive/1/357064/2004-03-08/2004-03-14/0
http://www.securityfocus.com/bid/9848
https://exchange.xforce.ibmcloud.com/vulnerabilities/15443
http://marc.info/?l=bugtraq&m=107904890724201&w=2
http://secunia.com/advisories/11111
http://www.kb.cert.org/vuls/id/831534
http://www.securityfocus.com/archive/1/357064/2004-03-08/2004-03-14/0
http://www.securityfocus.com/bid/9848
https://exchange.xforce.ibmcloud.com/vulnerabilities/15443

Get alerted when CVE-2004-1769 or the next vulnerability affects your stack