CVE-2026-32993

Wednesday, May 13, 2026

8.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Summary

Improper sanitization of the status query parameter of the /unprotected/nova_error endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.

Affected Software

Vendor	Product	Version Range	Status
WebPros	cPanel	`11.132.0.0 < 11.132.0.32`	affected
WebPros	cPanel	`11.134.0.0 < 11.134.0.26`	affected
WebPros	cPanel	`11.136.0.0 < 11.136.0.10`	affected
WebPros	WP Squared	`11.132.1.0 < 11.136.1.12`	affected

Weaknesses

CWE-93: CWE-93 CRLF Injection

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: yes
- Technical Impact: partial

References

https://support.cpanel.net/hc/en-us/articles/40437313190295-Security-CVE-2026-32993-cPanel-WHM-WP2-Security-Update-May-13-2026

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.

←Previous
Next→