This vulnerability is a stored cross‑site scripting flaw in the ticket reply notification system of CtrlPanel. Unsanitized reply content is written into the database and later rendered via Blade’s unescaped syntax, allowing an attacker to inject arbitrary JavaScript that executes in the victim’s browser session. The executed script can hijack administrative sessions, hijack credentials with fake prompts or keyloggers, and perform admin actions on behalf of the victim. The flaw exists in both admin‑to‑user and user‑to‑admin notifications and supports privilege escalation through session takeover.

CtrlPanel Open‑Source billing software, version 1.1.1 and earlier. The affected components are the ticket reply notification classes for admins and users. Only installations that have not applied the 1.2.0 update remain vulnerable.

The CVSS score of 8.7 indicates a high impact with a low required skill level, as the attacker only needs to post a malicious reply that will later be rendered for recipients. The EPSS score is not available, but the vulnerability is listed as not condemned in the CISA KEV catalog, implying no known public exploitation. The likely attack vector is the web interface where tickets are replied to; from there the attacker’s payload is stored and later executed in the recipient’s browser when they view the notification. The low privilege requirement and the direct effect on session integrity make exploitation highly probable in targeted or opportunistic scenarios.