The vulnerability is a Stored Cross‑Site Scripting flaw where role names and colors are output raw in a data table without sanitization. This is an example of CWE‑116 (Improper Encoding for Output) and CWE‑80 (Cross‑Site Scripting). An administrator with ability to create or edit roles can store crafted HTML or JavaScript in these fields, which the browser will subsequently execute when any admin visits the /admin/roles page. This capability enables an attacker to hijack admin sessions, steal credentials, or perform actions on behalf of victims through the vulnerable page. The flaw is present in CtrlPanel versions 1.1.1 and earlier. The impacted product, a billing platform used by hosting providers, allows role management via a DataTables interface that renders the name column as raw HTML. The issue was patched in release 1.2.0. Although the CVSS score is moderate at 4.8 and no EPSS data is available, the risk is limited to accounts that have authority to create or edit roles. An attacker needs an existing privileged account to inject the payload, and the compromise requires an admin to load the vulnerable page, making widespread exploitation unlikely. Nevertheless, the flaw permits serious privilege escalation within an organization.

CtrlPanel billing software by Ctrlpanel‑gg, specifically the panel component. Versions 1.1.1 and earlier are vulnerable, while the issue was resolved in release 1.2.0.

CVSS score of 4.8 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector requires an administrator with role‑creation or editing rights to inject a payload; the malicious code is stored and executed whenever an admin loads the /admin/roles page. Because the exploitation depends on privileged access and a specific page view, the overall risk is moderate but organizations should patch promptly.