Ctrlpanel-gg vulnerabilities
We track 4 vulnerabilities in Ctrlpanel-gg products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 19, 2026.
Latest Ctrlpanel-gg vulnerabilities
- 8.1 High severity
panel: Improper Access Control
CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods but omit equivalent checks on the corres
- 8.7 High severity
panel: Improper Neutralization of Input During Web Page Generation
CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database
- 10.0 Critical severity
panel: Improper Neutralization of Special Elements used in an OS Command
CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only afte
- 8.1 High severity
panel: Improper Neutralization of Input During Web Page Generation
CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting (XSS) vulnerability exists in the `TicketsController` and `Moderation/TicketsController` due to insufficient input validation on the `priority` field