CVE-2026-41472

Katalog CVE

CVSS 6.1 · Medium EPSS 0,64%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada cyberpanel. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.

Rincian

Terbit di NVD

24 April 2026

Terakhir diubah

11 Agustus 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://itsrez.re/post/cyberpanel-rce exploit · mitigasi · advisory pihak ketiga
• https://www.vulncheck.com/advisories/cyberpanel-stored-xss-via-ai-scanner-dashboard advisory pihak ketiga
• https://github.com/usmannasir/cyberpanel/commit/8eb29181cb137baa4adb4bba5dce60f601d55a5f