A stored cross-site scripting vulnerability in Ctrlpanel could allow an authenticated attacker to execute arbitrary scripts in the context of other users' sessions.

This is an Improper Neutralization of Input during Web Page Generation (CWE-79) vulnerability. An authenticated attacker with low privileges can inject malicious scripts, which are then rendered in the browser of other users, including administrators, when they access the compromised interface.

Successful exploitation allows for session hijacking, unauthorized actions performed on behalf of legitimate users, and potential theft of sensitive billing or hosting configuration data. With a CVSS score of 8.7, this is a High-severity risk that could lead to significant account takeover scenarios within the hosting management environment.

Immediate Action: Upgrade to Ctrlpanel version 1.2.0 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review application logs for unusual script tags or unexpected characters in user-submitted input fields.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common XSS patterns.

Public Exploit Available: Unknown.

Given the potential for privilege escalation and session compromise, organizations should prioritize the update to version 1.2.0. Failure to patch leaves administrative accounts vulnerable to script-based attacks that could compromise the entire hosting infrastructure.