https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:23:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-351192 EUVD-2026-351192 https://cve.radiocsirt.org/vuln/euvd-2026-351192 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41472 <p>CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator&#39;s authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.</p> <p>CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator&#39;s authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41472 https://cve.radiocsirt.org/vuln/ghsa-7jgx-wx3x-3fp3 <p>CyberPanel versions prior to 2.4.4 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator&#39;s authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.</p> <p>CyberPanel versions prior to 2.4.4 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator&#39;s authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.</p> https://cve.radiocsirt.org/vuln/ghsa-7jgx-wx3x-3fp3 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1269 <p>Ein Angreifer kann mehrere Schwachstellen in CyberPanel ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen. Die Kombination der beiden Schwachstellen kann zur Ausführung von beliebigem Code führen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in CyberPanel ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen. Die Kombination der beiden Schwachstellen kann zur Ausführung von beliebigem Code führen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1269