Ctrlpanel has stored XSS vulnerability in TicketsController priority field
Priority HIGH 70CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting (XSS) vulnerability exists in the `TicketsController` and `Moderation/TicketsController` due to insufficient input validation on the `priority` field during ticket creation and unsafe rendering of this field in the moderator panel. Version 1.0 contains a patch for the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Fix Fixed panel (Ctrlpanel-gg): 1.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ctrlpanel-gg | panel | before 1.0 | 1.0 | Patch available | CNA |
- panel VendorCtrlpanel-gg Affected before 1.0 Fixed in 1.0 Patch available CNA
Remediation
- Fix · CNA panel (Ctrlpanel-gg) Fixed in 1.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-25203
References
More Ctrlpanel-gg vulnerabilities
- TI-2026-26529 CtrlPanel: Unauthenticated RCE using installer script CVSS 3.1CRITICAL 10.0
- TI-2026-26536 CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking CVSS 3.1HIGH 8.7
- TI-2026-26644 CtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass CVSS 3.1HIGH 8.1
- TI-2026-26511 CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php CVSS 3.1MEDIUM 6.6
- TI-2026-26528 CtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints CVSS 3.1MEDIUM 6.5
- TI-2026-26541 CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output CVSS 3.1MEDIUM 4.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences