CVE-2026-41472
CyberPanel < 2.4.4 Stored XSS via AI Scanner Dashboard
Vexday Risk Score
33Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 5.3EPSS 0.5%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado
Lifecycle
24 Apr 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
CyberPanel versions prior to 2.4.4 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Affected products
usmannasir · cyberpanelpublic PoCs found — 1
cve_referenceitsrez.re/post/cyberpanel-rceunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →