CVE-2004-1769 in the critical feed json
The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attac…
published 2004-03-11 22 y ago modified 2026-06-16 4 mo ago also EUVD-2004-1763
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 34.8%
- EPSS 34.8% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.
Timeline
- First public exploit (EDB-23804)
- Published
Exploit prediction
34.83% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-23804 cPanel 5/6/7/8/9 - Resetpass Remote Command Execution remote, 2004-03-11
- securityfocus.com http://www.securityfocus.com/bid/9848 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
References
-
securityfocus.com
/bid/9848
vdb-entry, exploit, vendor-advisory
-
securityfocus.com
/archive/1/357064/2004-03-08/2004-03-14/0
mailing-list, vendor-advisory
-
secunia.com
/advisories/11111
third-party-advisory, vendor-advisory
-
kb.cert.org
/vuls/id/831534
third-party-advisory, us-government-resource
-
marc.info
/?l=bugtraq&m=107904890724201&w=2
mailing-list
-
exchange.xforce.ibmcloud.com
/vulnerabilities/15443
vdb-entry
Sources
- CVE List CVE-2004-1769
- NVD CVE-2004-1769
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.