Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2026-41472 EUVD-2026-25630GHSA-7jgx-wx3x-3fp3

CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard

Published Apr 24, 2026 · Updated Aug 11, 2026 · Assigned by VulnCheck

Vendor: usmannasir Product: cyberpanel

Description

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.

Affected products

VendorProductAffectedFixed
usmannasir cyberpanel < 2.4.5 2.4.5

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References