What’s Vulnerable › Vulnerabilities

CVE-2022-0838: Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-04 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.

Affected products

• hestiacp Control Panel: before 1.5.10 — fixed in 1.5.10

How to fix

Upgrade to a fixed version: hestiacp Control Panel 1.5.10. Check the vendor advisory for mitigations.

References

• https://github.com/hestiacp/hestiacp/commit/640f822d306ffb3eddf8ce2f46de75d7344283c1
• https://huntr.dev/bounties/bd2fb1f1-cc8b-4ef7-8e2b-4ca686d8d614
• https://github.com/hestiacp/hestiacp/commit/640f822d306ffb3eddf8ce2f46de75d7344283c1
• https://huntr.dev/bounties/bd2fb1f1-cc8b-4ef7-8e2b-4ca686d8d614

Get alerted when CVE-2022-0838 or the next vulnerability affects your stack