Litespeed Technologies vulnerabilities
21 vulnerabilities
Known vulnerabilities in Litespeed Technologies products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.
Products
7- Litespeed Cache12 vulnerabilities
- Litespeed Web Server5 vulnerabilities
- Openlitespeed Web Server3 vulnerabilities
- Cpanel Plugin2 vulnerabilities
- Openlitespeed2 vulnerabilities
- LSWS Enterprise1 vulnerabilities
- WHM Plugin1 vulnerabilities
CVE-2021-47855litespeed technologiesopenlitespeed
EPSS score0.28%
Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts. Attackers can craft a payload in the Notes field during listener configuration that will execute when an administrator clicks on the Default Icon.CVE-2007-5654litespeed_technologieslitespeed_web_serverEPSS score41.06%
LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime Type Injection."CVE-2025-47437litespeed technologieslitespeed cache+1EPSS score0.26%
Server-Side Request Forgery (SSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 7.0.1.CVE-2005-3695litespeed_technologieslitespeed_web_serverEPSS score1.93%
Cross-site scripting (XSS) vulnerability in admin/config/confMgr.php in LiteSpeed Web Server 2.1.5 allows remote attackers to inject arbitrary web script or HTML via the m parameter.CVE-2022-0074litespeed_technologieslitespeed_web_server+2EPSS score1.26%
Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This affects versions from 1.6.15 before 1.7.16.1.CVE-2022-0073litespeed_technologieslitespeed_web_server+2EPSS score9.21%
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This affects 1.7.0 versions before 1.7.16.1.CVE-2022-0072litespeed_technologieslitespeed_web_server+2EPSS score0.99%
Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1CVE-2022-46800litespeed technologieslitespeed cache+2EPSS score0.26%
Cross-Site Request Forgery (CSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache plugin <= 5.3 versions.CVE-2024-51915litespeed technologieslitespeed cache+1EPSS score0.25%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.2.CVE-2024-47374litespeed technologieslitespeed cache+2EPSS score1.40%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.0.2.CVE-2024-47637litespeed technologieslitespeed cache+2EPSS score0.65%
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1.CVE-2024-47373litespeed technologieslitespeed cache+2EPSS score0.26%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.0.2.CVE-2024-44000litespeed technologieslitespeed cache+2EPSS score82.34%
Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.CVE-2024-28000litespeed technologieslitespeed cache+2EPSS score68.27%
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.CVE-2024-50550litespeed technologieslitespeed cache+2EPSS score0.90%
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through <= 6.5.1.CVE-2026-54420litespeed technologiescpanel plugin+2KEVEPSS score0.81%
LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.CVE-2026-84761litespeed technologieslitespeed cache+1EPSS score0.27%
Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.CVE-2026-48172litespeed technologiescpanel plugin+3KEVEPSS score1.01%
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.CVE-2026-31386litespeed technologieslsws enterprise+3EPSS score2.21%
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.CVE-2023-40000litespeed technologieslitespeed cache+2EPSS score54.87%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.