CVE-2025-52206
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage. This allows an attacker to inject malicious scripts into the administrator's browser.
Risk Assessment
An attacker could hijack the admin session, steal credentials, or perform unauthorized actions in the hosting management panel.
Recommendation
Immediately update ISPConfig to the latest version and apply input filtering for data displayed on the system status page.
Other vulnerabilities in ISPConfig
See all- CVE-2017-17384High
ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.
- CVE-2026-61518High
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter in delete and update methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized binding. A user with any low-privilege function permission can inject arbitrary SQL, delete or modify records across all tenants, and extract data including password hashes.
Original NVD description (English source)
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.