Ctrlpanel-Gg Panel vulnerabilities

CVE-2026-34234 [CRITICAL] CWE-78 CVE-2026-34234: CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the we CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on alr

CVE-2026-34358 [HIGH] CWE-284 CVE-2026-34358: CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods but omit equivalent checks on the corresponding write methods, allowing any authenticated user to bypass RBAC via direct POST/PATCH r

CVE-2026-34241 [HIGH] CWE-79 CVE-2026-34241: CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade's {!! !!} syntax in the recipient'

CVE-2026-34216 [MEDIUM] CWE-470 CVE-2026-34216: CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the ad CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the admin settings update endpoint accepted a fully qualified class name directly from user-supplied request input and used it for dynamic static method calls and object instantiation without any allowlist validation, allowing for authenticated Remote Code

CVE-2026-34233 [MEDIUM] CWE-284 CVE-2026-34233: CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, multip CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, multiple admin controllers expose DataTable endpoints without authorization checks, allowing any authenticated user to access sensitive administrative data that should be restricted to administrators only. The affected admin controllers define datatable() m

CVE-2025-25203 [HIGH] CWE-79 CVE-2025-25203: CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting (XSS) vulnerability exists in the `TicketsController` and `Moderation/TicketsController` due to insufficient input validation on the `priority` field during ticket creation and unsafe rendering of this field in the moderator panel. Version 1.0 c

CVE-2026-34246 [MEDIUM] CWE-80 CVE-2026-34246: CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability exists in the admin role management interface. In app/Http/Controllers/Admin/RoleController.php, the datatable() method interpolates $role->name and $role->color directly into a element's HTML and style at