EUVD-2026-67917
GHSA-9h98-8grg-fqrg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attacker needs no oPanel credentials (PR:N) but victim must actively perform DNS lookup (UI:R); scope changes because JS executes in browser context (S:C), with limited confidentiality and integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record
AnalysisAI
Cross-site scripting in oPanel's DNS lookup and management component before v1.20.25 allows a remote unauthenticated attacker who controls any DNS zone to inject arbitrary JavaScript into an authenticated panel user's browser session by poisoning a DNS TXT record with a crafted payload. When a panel user performs a DNS lookup on the attacker-controlled domain, the unsanitized TXT record value executes in the victim's browser context, enabling session token theft and full account takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete preconditions: (1) the attacker controls at least one registered domain and has the ability to set its DNS TXT records to arbitrary content; (2) a victim with an active authenticated oPanel session manually uses the panel's DNS lookup or DNS management interface to query that attacker-controlled domain; and (3) the target oPanel instance is running a version prior to v1.20.25. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 medium score is structurally depressed by the UI:R requirement - a victim must actively perform a DNS lookup on the attacker's domain - which prevents mass automated exploitation and is reflected in the EPSS of 0.37% (30th percentile). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade oPanel to v1.20.25 or later, which resolves the failure to sanitize DNS TXT record output in the DNS management component. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today