CVE-2026-50980

Low risk· EPSS 30%

Published: 28/08/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before version 1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record.

Risk Assessment

Attackers can hijack administrator sessions, leading to unauthorized access to the management panel and potential compromise of the entire infrastructure.

Recommendation

Update oPanel to version 1.20.25 or later as soon as possible, as it contains a fix for the XSS vulnerability.

Other vulnerabilities in oPanel

CVE-2026-50979High
A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter.

Original NVD description (English source)

Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record