Ctrlpanel-gg panel vulnerabilities

Latest Ctrlpanel-gg panel CVEs

Newest publication first

1. CVE-2026-34358 CtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass

   Published 2026-05-19

   High·CVSS 8.1 EPSS 0.30%

   CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods but omit equivalent checks on the corresponding write method...

2. CVE-2026-34246 CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output

   Published 2026-05-19

   Medium·CVSS 4.8 EPSS 0.22%

   CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability exists in the admin role management interface. In app/Http/Controllers/Admin/RoleController.php, the datatable() method interpolates...

3. CVE-2026-34241 CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking

   Published 2026-05-19

   High·CVSS 8.7 EPSS 0.35%

   CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payload...

4. CVE-2026-34234 CtrlPanel: Unauthenticated RCE using installer script

   Published 2026-05-19

   Critical·CVSS 10.0 EPSS 3.2%

   CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and exec...

5. CVE-2026-34233 CtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints

   Published 2026-05-19

   Medium·CVSS 6.5 EPSS 0.28%

   CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, multiple admin controllers expose DataTable endpoints without authorization checks, allowing any authenticated user to access sensitive administrative data that should be restricted to a...

6. CVE-2026-34216 CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php

   Published 2026-05-19

   Medium·CVSS 6.6 EPSS 0.53%

   CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the admin settings update endpoint accepted a fully qualified class name directly from user-supplied request input and used it for dynamic static method calls and object instantiation wi...

7. CVE-2025-25203 Ctrlpanel has stored XSS vulnerability in TicketsController priority field

   Published 2025-02-11

   High·CVSS 8.1 EPSS 0.44%

   CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting (XSS) vulnerability exists in the TicketsController and Moderation/TicketsController due to insufficient input validation on the priority field during ticket creation and...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.