← Vulnerability feed
Start free
Open in platform
Vulnerability record · CVE-2019-9841 · published 19 April 2019
CVE-2019-9841: Vestacp control panel cross-site scripting vulnerability
Vestacp · Control Panel
Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.
6.1 CVSS 3.0 Medium EPSS 1.3% · top 30.2% CWE-79 · Cross-site scripting
6.1CVSS 3.0 base score, v2 4.3
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD
Description
Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://cardaci.xyz/advisories/2019/04/15/vesta-control-panel-0.9.8-23-reflected-xss-in-file-manager-api/ | ExploitThird Party Advisory |
| https://forum.vestacp.com/viewtopic.php?f=25&t=18599&sid=fc1a48fd2f43815b2dc69c3f64caed36 | Release NotesVendor Advisory |
| https://github.com/serghey-rodin/vesta/commit/c28c5d29a3c61bc8110c11349e3f2309cd537cfa | PatchThird Party Advisory |
| https://cardaci.xyz/advisories/2019/04/15/vesta-control-panel-0.9.8-23-reflected-xss-in-file-manager-api/ | ExploitThird Party Advisory |
| https://forum.vestacp.com/viewtopic.php?f=25&t=18599&sid=fc1a48fd2f43815b2dc69c3f64caed36 | Release NotesVendor Advisory |
| https://github.com/serghey-rodin/vesta/commit/c28c5d29a3c61bc8110c11349e3f2309cd537cfa | PatchThird Party Advisory |
Track CVE-2019-9841 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
8.8CVE-2019-12791Vestacp control panel path traversal vulnerabilityA directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular regist…EPSS 6.5%8.8CVE-2019-12792Vestacp control panel os command injection vulnerabilityA command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered us…EPSS 4.9%8.8CVE-2015-4117Vestacp control panel os command injection vulnerabilityVesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter …EPSS 11%7.8CVE-2022-3967Vestacp control panel vulnerabilityA vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the …EPSS 0.23%7.8CVE-2021-30463Vestacp control panel link following vulnerabilityVestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY va…EPSS 0.50%7.2CVE-2021-46850Vestacp control panel argument injection vulnerabilitymyVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote adm…EPSS 5.4%6.5CVE-2020-10966Hestiacp control panel vulnerabilityIn the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account…EPSS 1.9%6.1CVE-2018-18547Vestacp control panel cross-site scripting vulnerabilityVesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, t…EPSS 1.1%
Source: NIST National Vulnerability Database (record CVE-2019-9841), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
