PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-52206 ISPConfig CVE debrief

CVE-2025-52206 is a Cross Site Scripting (XSS) vulnerability in ISPConfig 3.3.0 via the system status webpage. The vulnerability has a CVSS score of 4.7 and a severity of MEDIUM. This vulnerability allows an attacker to inject malicious JavaScript code, potentially leading to unauthorized actions or data exposure. Users of ISPConfig 3.3.0 should be aware of this vulnerability and take steps to mitigate it. The basis for this debrief is the CVE record and NVD entry, which indicate a need for input validation improvements.

Vendor
ISPConfig
Product
ISPConfig 3.3.0
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-05
Original CVE updated
2026-07-05
Advisory published
2026-05-05
Advisory updated
2026-07-05

Who should care

Users of ISPConfig 3.3.0, particularly those responsible for system administration, security, and vulnerability management, should be aware of this vulnerability. Operators of ISPConfig 3.3.0 need to assess their exposure and implement necessary mitigations to prevent exploitation. Security teams should prioritize this vulnerability based on its CVSS score and potential impact on their systems.

Technical summary

The vulnerability is caused by a lack of input validation on the system status webpage, allowing an attacker to inject malicious JavaScript code. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. This issue arises from inadequate sanitization of user inputs, which could lead to the execution of arbitrary JavaScript code within the context of the system status webpage.

Defensive priority

Medium priority due to the CVSS score and severity. Given the potential for code injection, defenders should prioritize reviewing and validating user input on the system status webpage and consider implementing additional security measures such as Content Security Policy (CSP) to prevent XSS attacks.

Recommended defensive actions

  • Apply the patch or update to ISPConfig 3.3.0p2 as recommended by the vendor.
  • Review and validate user input on the system status webpage.
  • Implement additional security measures such as Content Security Policy (CSP) to prevent XSS attacks.

Evidence notes

The CVE record was published on 2026-05-05T16:16:09.633Z and last modified on 2026-07-05T02:16:54.757Z. The NVD entry is currently Modified. Evidence is limited to CVE and NVD data, which may not encompass all affected configurations or potential attack vectors. Defenders should verify system status webpage input validation and review for additional vulnerabilities.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-05T16:16:09.633Z and has not been modified since then. The NVD entry is currently Modified.