support@hackerone.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS support@hackerone.com
03
assessed vulnerabilities (517)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-105474US | — | — | ||
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root. | ||||
| CVE-2026-93699US | — | — | ||
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server. | ||||
| CVE-2026-93026US | —OT elevated | — | ||
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials. | ||||
| CVE-2026-58069US | — | — | ||
This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host. | ||||
| CVE-2026-58068US | —OT elevated | — | ||
This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system. | ||||
| CVE-2025-64393US | — | — | ||
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server. | ||||
| CVE-2025-64392US | — | — | ||
This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link. | ||||
| CVE-2025-64391US | — | — | ||
This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it. | ||||
| CVE-2026-93698US | — | — | ||
Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. | ||||
| CVE-2026-93697US | — | — | ||
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. | ||||
| CVE-2026-93029US | — | — | ||
There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. | ||||
| CVE-2026-87900US | — | — | ||
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts. | ||||
| CVE-2026-87899US | — | — | ||
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. | ||||
| CVE-2026-87898US | — | — | ||
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. | ||||
| CVE-2026-68492US | — | — | ||
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via t… | ||||
| CVE-2026-68490US | — | — | ||
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts. | ||||
| CVE-2026-77166US | — | — | ||
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide othe… | ||||
| CVE-2026-77165US | — | — | ||
File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database. | ||||
| CVE-2026-82985US | — | — | ||
The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owne… | ||||
| CVE-2026-82982US | — | — | ||
The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose content… | ||||