Skip to content
OpenAdvisories

Product · Ctrlpanel-gg

panel

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-34358

    CtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass

    CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods but omit equivalent checks on the corre…

    Ctrlpanel-gg panel
  • High 8.7
    CVE-2026-34241

    CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking

    CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database…

    Ctrlpanel-gg panel
  • High 8.1
    CVE-2025-25203

    Ctrlpanel has stored XSS vulnerability in TicketsController priority field

    CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting (XSS) vulnerability exists in the `TicketsController` and `Moderation/TicketsController` due to insufficient input validation on the `priority` field…

    Ctrlpanel-gg panel