CVE-2026-41472

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/usmannasir/cyberpanel/commit/8eb29181cb137baa4adb4bba5dce60f601d55a5f
https://itsrez.re/post/cyberpanel-rce	Exploit Mitigation Third Party Advisory
https://www.vulncheck.com/advisories/cyberpanel-stored-xss-via-ai-scanner-dashboard	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de CyberPanel anteriores a la 2.4.4 contienen una vulnerabilidad de cross-site scripting almacenado en el panel de control de AI Scanner donde el endpoint POST /API/ai-scanner/callback carece de autenticación y permite a atacantes no autenticados inyectar JavaScript malicioso sobrescribiendo el campo findings_json de los registros de ScanHistory. Los atacantes pueden inyectar JavaScript que se ejecuta en la sesión autenticada de un administrador cuando visitan el panel de control de AI Scanner, permitiéndoles emitir solicitudes del mismo origen para plantar tareas cron y lograr la ejecución remota de código en el servidor.

Information

Published : 2026-04-24 21:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-41472

Mitre link : CVE-2026-41472

CVE.ORG link : CVE-2026-41472

JSON object : View

Products Affected

cyberpanel

cyberpanel

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-41472", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41472", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:37:10.501228Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/usmannasir/cyberpanel", "vendor": "usmannasir", "product": "cyberpanel", "versions": [{"status": "affected", "version": "0", "lessThan": "2.4.5", "versionType": "semver"}, {"status": "unaffected", "version": "8eb29181cb137baa4adb4bba5dce60f601d55a5f", "versionType": "git"}], "packageURL": "pkg:github/usmannasir/cyberpanel", "defaultStatus": "unaffected"}]}], "published": "2026-04-24T21:16:18.967", "references": [{"url": "https://github.com/usmannasir/cyberpanel/commit/8eb29181cb137baa4adb4bba5dce60f601d55a5f", "source": "disclosure@vulncheck.com"}, {"url": "https://itsrez.re/post/cyberpanel-rce", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/cyberpanel-stored-xss-via-ai-scanner-dashboard", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "CyberPanel versions prior to\u00a02.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server."}, {"lang": "es", "value": "Las versiones de CyberPanel anteriores a la 2.4.4 contienen una vulnerabilidad de cross-site scripting almacenado en el panel de control de AI Scanner donde el endpoint POST /API/ai-scanner/callback carece de autenticaci\u00f3n y permite a atacantes no autenticados inyectar JavaScript malicioso sobrescribiendo el campo findings_json de los registros de ScanHistory. Los atacantes pueden inyectar JavaScript que se ejecuta en la sesi\u00f3n autenticada de un administrador cuando visitan el panel de control de AI Scanner, permiti\u00e9ndoles emitir solicitudes del mismo origen para plantar tareas cron y lograr la ejecuci\u00f3n remota de c\u00f3digo en el servidor."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7FB98A7-0882-4C43-9D46-B23C60D07630", "versionEndExcluding": "2.4.4"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}