Stored XSS in DirectAdmin Evo Skin
Priority MEDIUM 40CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store malicious JavaScript code. If an admin views the ticket, the script might perform actions with their privileges, including command execution. This issue has been fixed in version 1.668 of DirectAdmin Evolution Skin.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00664 51st percentileScored 2026-11-07
Fix Fixed DirectAdmin Evolution Skin (DirectAdmin): 1.668
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| DirectAdmin | DirectAdmin Evolution Skin | before 1.668 | 1.668 | Patch available | CNA |
- DirectAdmin Evolution Skin VendorDirectAdmin Affected before 1.668 Fixed in 1.668 Patch available CNA
Remediation
- Fix · CNA DirectAdmin Evolution Skin (DirectAdmin) Fixed in 1.668
Timeline
- 2026-10-02 Threatist record created from CVE-2024-10385
- 2026-10-03 Alias added: GHSA-5vp4-pvmw-cjmm
- 2026-10-06 EPSS moved to the 50th–90th percentile
References
More DirectAdmin vulnerabilities
- TI-2025-35368 An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page… CVSS 3.1HIGH 8.2
- TI-2017-13253 JBMC DirectAdmin before 1.52, when the email_ftp_password_change setting is nonzero… CVSS 3.0CRITICAL 9.8
- TI-2019-07040 JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account. CVSS 3.0HIGH 8.8
- TI-2009-01446 CMD_DB in JBMC Software DirectAdmin before 1.334 allows remote authenticated users to… CVSS 2.0HIGH 8.5
- TI-2007-01848 Cross-site scripting (XSS) vulnerability in JBMC Software DirectAdmin before 1.293 does… CVSS 2.0MEDIUM 6.8
- TI-2019-08374 The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2024-10385 · CVE Program
- CVE-2024-10385 · NVD
- FIRST EPSS
- GHSA-5vp4-pvmw-cjmm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences