CVE-2025-25203
Ctrlpanel has stored XSS vulnerability in TicketsController priority field
Summary
Ctrlpanel has stored XSS vulnerability in TicketsController priority field
Original description
The description as published by the source.
CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting (XSS) vulnerability exists in the TicketsController and Moderation/TicketsController due to insufficient input validation on the priority field during ticket creation and unsafe rendering of this field in the moderator panel. Version 1.0 contains a patch for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com