PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-52206 ISPConfig CVE debrief

CVE-2025-52206 is a Cross Site Scripting (XSS) vulnerability in ISPConfig 3.3.0 via the system status webpage. The vulnerability has a CVSS score of 4.7 and a severity of MEDIUM. This vulnerability allows an attacker to inject malicious JavaScript code, potentially leading to unauthorized actions or data exposure. Users of ISPConfig 3.3.0 should be aware of this vulnerability and take steps to mitigate it. The basis for this debrief is the CVE record and NVD entry, which indicate a need for input validation improvements.

Vendor
ISPConfig
Product
ISPConfig 3.3.0
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-05
Original CVE updated
2026-07-05
Advisory published
2026-05-05
Advisory updated
2026-07-05

Who should care

Users of ISPConfig 3.3.0, particularly those responsible for system administration, security, and vulnerability management, should be aware of this vulnerability. Operators of ISPConfig 3.3.0 need to assess their exposure and implement necessary mitigations to prevent exploitation. Security teams should prioritize this vulnerability based on its CVSS score and potential impact on their systems.

Technical summary

The vulnerability is caused by a lack of input validation on the system status webpage, allowing an attacker to inject malicious JavaScript code. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. This issue arises from inadequate sanitization of user inputs, which could lead to the execution of arbitrary JavaScript code within the context of the system status webpage.

Defensive priority

Medium priority due to the CVSS score and severity. Given the potential for code injection, defenders should prioritize reviewing and validating user input on the system status webpage and consider implementing additional security measures such as Content Security Policy (CSP) to prevent XSS attacks.

Recommended defensive actions

  • Apply the patch or update to ISPConfig 3.3.0p2 as recommended by the vendor.
  • Review and validate user input on the system status webpage.
  • Implement additional security measures such as Content Security Policy (CSP) to prevent XSS attacks.

Evidence notes

The CVE record was published on 2026-05-05T16:16:09.633Z and last modified on 2026-07-05T02:16:54.757Z. The NVD entry is currently Modified. Evidence is limited to CVE and NVD data, which may not encompass all affected configurations or potential attack vectors. Defenders should verify system status webpage input validation and review for additional vulnerabilities.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-52206 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-52206

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-52206 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-52206

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.