CVE-2026-41472

UNKNOWN 0.0

CyberPanel < 2.4.4 Stored XSS via AI Scanner Dashboard

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

CyberPanel versions prior to 2.4.4 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.

CWE	CWE-79
Vendor	usmannasir
Product	cyberpanel
Published	Apr 24, 2026

Stay Ahead of the Next One

Get instant alerts for usmannasir cyberpanel

Be the first to know when new unknown vulnerabilities affecting usmannasir cyberpanel are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

usmannasir / cyberpanel

0 < 2.4.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

itsrez.re: https://itsrez.re/post/cyberpanel-rce github.com: https://github.com/usmannasir/cyberpanel/commit/0a099b1b193946555fbdd387a28486b1521f9961 vulncheck.com: https://www.vulncheck.com/advisories/cyberpanel-stored-xss-via-ai-scanner-dashboard

Credits

Djibril Mounkoro