These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2025-30008 is a stored cross-site scripting vulnerability in HestiaCP before 1.9.5. The vulnerability allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in l [truncated]
CVE-2025-30007 HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability. Low-privilege authenticated users can execute arbitrary root commands by injecting a single-quote character into unvalidated DNS record types. The vulnerability arises from insufficient input validation in is_dns_record_format_valid() and unsafe eval-based parsing in update_domain_zone().
CVE-2026-43634 is a high-severity IP spoofing flaw in HestiaCP. According to the published description, affected versions 1.2.0 through 1.9.4 accept an arbitrary CF-Connecting-IP value without first verifying that the request actually came from Cloudflare. That breaks the trust model for client-IP handling and can let unauthenticated remote attackers bypass IP-based authentication controls, evade brute-fo [truncated]
CVE-2026-43633 describes a critical deserialization weakness in HestiaCP’s web terminal feature affecting versions 1.9.0 through 1.9.4. The issue arises from a session format mismatch between PHP and Node.js: attacker-controlled data can be injected into HTTP headers, handled by the PHP session layer, and then incorrectly treated as trusted session content by the Node.js web terminal component. In the des [truncated]