← CVE Intelligence

CVE-2026-29206

WebPros / cPanel PUBLISHED

Description (CNA)

Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

Affected (CNA)

Vendor / product	Versions
WebPros / cPanel	affected 11.136.0.0 before 11.136.0.10; affected 11.134.0.0 before 11.134.0.26; affected 11.132.0.0 before 11.132.0.32; affected 11.130.0.0 before 11.130.0.23; affected 11.126.0.0 before 11.126.0.59; affected 11.124.0.0 before 11.124.0.38; affected 11.118.0.0 before 11.118.0.67; affected 11.110.0.0 before 11.110.0.119; affected 11.102.0.0 before 11.102.0.42; affected 11.94.0.0 before 11.94.0.31; affected 11.30.0.0 before 11.86.0.44
WebPros / WP Squared	affected 11.136.1.0 before 11.136.1.12
WebPros / cPanel (CloudLinux 6, CentOS 6)	affected 11.110.0.0 before 11.110.0.118

CWE

CWE-89

References

https://support.cpanel.net/hc/en-us/articles/40437213099159-Security-CVE-2026-29206-cPanel-WHM-WP2-Security-Update-May-13-2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.