EUVD-2025-209641Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.
AnalysisAI
ISPConfig 3.3.0 allows reflected cross-site scripting (XSS) attacks via the system status webpage, enabling unauthenticated remote attackers to inject malicious scripts that execute in a victim's browser when they visit a crafted link. The vulnerability requires user interaction (clicking a malicious link) but can result in session hijacking, credential theft, or other client-side attacks. A patched version (3.3.0p2) has been released.
Technical ContextAI
This is a reflected XSS vulnerability (CWE-79) in ISPConfig's system status webpage. The vulnerability arises from insufficient input validation and output encoding of user-supplied parameters displayed on the status page. ISPConfig is a web-based server control panel used for managing hosting environments, DNS, email, and other services. The affected endpoint likely renders status information without properly sanitizing or escaping HTML/JavaScript, allowing attackers to break out of the intended context and inject arbitrary client-side code.
RemediationAI
Upgrade to ISPConfig 3.3.0p2 or later immediately, as the vendor has released a patched version explicitly addressing this XSS vulnerability. Follow the upgrade procedure documented at https://www.ispconfig.org/blog/ispconfig-3-3-0p2-released-security-update/. If immediate patching is not possible, apply compensating controls: restrict network access to the ISPConfig web interface to trusted administrator IP addresses or VPN, disable the system status webpage if not operationally required, or implement a Web Application Firewall (WAF) rule to block requests containing XSS payloads to the status endpoint. Note that these compensating controls do not eliminate the vulnerability and should be temporary measures only.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today