{"kind": "product", "path": "vulns/packagist/pterodactyl%2Fpanel", "name": "pterodactyl/panel", "product": "pterodactyl/panel", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-61609", "noindex": false, "published": "2026-07-28T15:45:57.570Z", "modified": "2026-07-28T19:28:14.470Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00498, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-61609", "title": "Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)", "description": "Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted ->by(), so Laravel derived a constant cache key (md5('authentication')) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47", "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e", "https://github.com/pterodactyl/panel/releases/tag/v1.13.0"], "fixes": ["1.13.0"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-54593", "noindex": false, "published": "2026-07-28T15:42:56.971Z", "modified": "2026-07-28T16:39:43.359Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "severity": "high", "epss": 0.00681, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-54593", "title": "Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions", "description": "Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to th", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-8r6w-3qq5-4p4r", "https://github.com/pterodactyl/panel/pull/5636", "https://github.com/pterodactyl/panel/commit/7ffcd636310bb72b54bac3280d2a15e727feded7"], "fixes": ["1.12.3"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "GHSA-j7f5-gfqm-pcx3", "noindex": false, "published": "2026-06-26T20:54:38Z", "modified": "2026-09-10T03:50:49.955127898Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-j7f5-gfqm-pcx3", "title": "Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system", "description": "### Summary\nAn unprotected user enumeration vulnerability exists in the account email update endpoint, allowing authenticated users to verify whether email addresses are registered on the panel through automated requests without rate limiting or CAPTCHA protection.\n\n### Details\nThe account settings page allows authenticated users to update their email address through a POST request. Unlike the login and password reset forms which implement reCAPTCHA and rate limiting protections, this endpoint lacks these safeguards entirely.\nAn attacker can capture the email update request (for example, using Burp Suite's proxy) and modify the email field to", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-j7f5-gfqm-pcx3", "https://github.com/pterodactyl/panel", "https://osv.dev/vulnerability/GHSA-j7f5-gfqm-pcx3"], "fixes": ["1.12.3"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-35202", "noindex": false, "published": "2026-06-02T19:03:46.792Z", "modified": "2026-06-03T12:47:52.123Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00212, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-35202", "title": "Pterodactyl has a database resource limit bypass via race condition in Client API", "description": "Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-fgmm-w5cx-vrfw", "https://nvd.nist.gov/vuln/detail/CVE-2026-35202"], "fixes": ["1.12.3"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-26016", "noindex": false, "published": "2026-02-19T15:55:20.064Z", "modified": "2026-02-20T15:42:39.382Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L", "severity": "critical", "epss": 0.0036, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-26016", "title": "Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization", "description": "Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about any server on a Pterodactyl instance, even if that server is associated with a different node. This issue stems from missing logic to verify that the node requesting server data is the same node that the server is associated with. Any authenticated Wings node can retrieve server installation scripts (potentially containing secret values) and manipulate the installation status of servers be", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728", "https://github.com/pterodactyl/panel/releases/tag/v1.12.1", "https://nvd.nist.gov/vuln/detail/CVE-2026-26016"], "fixes": ["1.12.1"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "GHSA-hr7j-63v7-vj7g", "noindex": false, "published": "2026-02-17T17:15:18Z", "modified": "2026-02-23T19:41:19.875455Z", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-hr7j-63v7-vj7g", "title": "Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change", "description": "### Summary\nDeleting a user account with SFTP access or changing the user's password does not immediately terminate existing SFTP sessions, allowing continued filesystem access after credentials are revoked.\nThis can result in unintended and unauthorized access to server files even after administrators believe access has been fully invalidated.\n\n\n### Details\nWhen a user with SFTP access is deleted from the Pterodactyl Panel or when the user's password is changed while one or more SFTP connections are active, those existing connections remain fully functional.\n\nNeither account deletion nor password change invalidates the authentication state o", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-hr7j-63v7-vj7g", "https://github.com/pterodactyl/panel/commit/0e74f3aadec89405751ec602c77fc1d030a417c0", "https://github.com/pterodactyl/panel"], "fixes": ["1.12.1"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-69198", "noindex": false, "published": "2026-01-19T19:05:38.530Z", "modified": "2026-01-20T20:05:30.610Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "severity": "medium", "epss": 0.00247, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-69198", "title": "Pterodactyl's improper resource locking allows raced queries to create more resources than alloted", "description": "Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocations, or backups) that can exist for an individual server. These resource limits are applied on a per-server basis, and validated during the request cycle. However, in versions prior to 1.12.0, it is possible for a malicious user to send a massive volume of requests at the same time that would create more resources than the server is allotted. This is because the validation occurs early in the request cycle and does not lock the target resource while it is processing", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-jw2v-cq5x-q68g", "https://github.com/pterodactyl/panel/commit/09caa0d4995bd924b53b9a9e9b4883ac27bd5607", "https://nvd.nist.gov/vuln/detail/CVE-2025-69198"], "fixes": ["1.12.0"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-69197", "noindex": false, "published": "2026-01-06T00:44:23.399Z", "modified": "2026-01-06T19:01:05.967Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00356, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-69197", "title": "Pterodactyl TOTPs can be reused during validity window", "description": "Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683", "https://github.com/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badf", "https://github.com/pterodactyl/panel/releases/tag/v1.12.0"], "fixes": ["1.12.0"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-68954", "noindex": false, "published": "2026-01-06T00:31:14.662Z", "modified": "2026-01-06T19:01:17.178Z", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00242, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-68954", "title": "Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced", "description": "Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-8c39-xppg-479c", "https://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5", "https://github.com/pterodactyl/panel/releases/tag/v1.12.0"], "fixes": ["1.12.0"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "GHSA-mgr9-6c2j-jxrq", "noindex": false, "published": "2025-12-30T15:13:52Z", "modified": "2025-12-30T15:37:59.047107Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-mgr9-6c2j-jxrq", "title": "Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”", "description": "> [!NOTE]\n> Message from the Pterodactyl team:\n>\n> The Pterodactyl team has evaluated this as a minor security issue but does not consider it something that should be assigned a CVE, nor does it require active patching by vulnerable systems.\n>\n> This issue is entirely self-inflicted and requires an administrative user paste an _obviously_ incorrect value into a database host field, submit it, and run into the XSS when the error message is rendered. However, we have determined that this fix is good security hygiene and may prevent issues in other areas not yet discovered.\n\n### Summary\nWhen an administrative user creates a new database host the", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-mgr9-6c2j-jxrq", "https://github.com/pterodactyl/panel/commit/1570ff250939b75b3ba8cd03e5025d8293544ed4", "https://github.com/pterodactyl/panel"], "fixes": ["1.12.0"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-49132", "noindex": false, "published": "2025-06-20T16:56:41.403Z", "modified": "2025-06-20T17:34:24.439Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.5446, "kev": false, "exploits": ["exploitdb", "metasploit", "nuclei", "public-poc"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-49132", "title": "Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution", "description": "Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF)", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-24wv-6c99-f843", "https://github.com/pterodactyl/panel/commit/24c82b0e335fb5d7a844226b08abf9f176e592f0", "https://github.com/pterodactyl/panel/releases/tag/v1.11.11"], "fixes": ["1.11.11"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-49762", "noindex": false, "published": "2024-10-24T21:39:24.986Z", "modified": "2024-10-25T17:20:35.873Z", "cvss": 4.6, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00141, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-49762", "title": "Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled", "description": "Pterodactyl is a free, open-source game server management panel. When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent.  While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user's password in plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could potentially authenticate against a user's account; assuming they are able to discover the account's email address or username separately. Th", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr", "https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4", "https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1"], "fixes": ["1.11.8"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-34067", "noindex": false, "published": "2024-05-03T17:38:18.268Z", "modified": "2024-08-02T02:42:59.886Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00457, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-34067", "title": "Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel", "description": "Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance could lead to cross site scripting (XSS) on the panel, which could be used to gain an administrator account on the panel. Specifically, the following things are impacted: Egg Docker images and Egg variables: Name, Environment variable, Default value, Description, Validation rules. Additionally, certain fields would reflect malicious input, but it would require the user knowingly entering such input to have an impact. To iterate, this would require an administrator to perform actions and c", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-384w-wffr-x63q", "https://github.com/pterodactyl/panel/commit/0dad4c5a488661f9adc27dd311542516d9bfa0f2", "https://github.com/pterodactyl/panel/commit/1172d71d31561c4e465dabdf6b838e64de48ad16"], "fixes": ["1.11.6"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "GHSA-7v3x-h7r2-34jv", "noindex": false, "published": "2022-01-21T18:43:05Z", "modified": "2024-12-04T05:42:03.933399Z", "cvss": 6, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-7v3x-h7r2-34jv", "title": "Insufficient Session Expiration in Pterodactyl API", "description": "### Impact\nA vulnerability exists in Pterodactyl Panel `<= 1.6.6` that could allow a malicious attacker that compromises an API key to generate an authenticated user session that is not revoked when the API key is deleted, thus allowing the malicious user to remain logged in as the user the key belonged to.\n\nIt is important to note that **a malicious user must first compromise an existing API key for a user to exploit this issue**. It cannot be exploited by chance, and requires a coordinated attack against an individual account using a known API key.\n\n### Patches\nThis issue has been addressed in the `v1.7.0` release of Pterodactyl Panel.\n\n###", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-7v3x-h7r2-34jv", "https://github.com/pterodactyl/panel/commit/dfa329ddf242908b60e22e3340ea36359eab1ef4", "https://github.com/pterodactyl/panel"], "fixes": ["1.7.0"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2021-41273", "noindex": false, "published": "2021-11-17T19:30:12.000Z", "modified": "2024-08-04T03:08:31.614Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00391, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2021-41273", "title": "Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys", "description": "Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment token. At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system. This has been addressed in release `1.6.6`. Users may optionally m", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-wwgq-9jhf-qgw6", "https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5", "https://nvd.nist.gov/vuln/detail/CVE-2021-41273"], "fixes": ["1.6.6"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2021-41176", "noindex": false, "published": "2021-10-25T16:50:10.000Z", "modified": "2024-08-04T02:59:31.636Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.0052, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2021-41176", "title": "logout CSRF in Pterodactyl Panel", "description": "Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.** This is fixed in version 1.6.3.", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-m49f-hcxp-6hm6", "https://github.com/pterodactyl/panel/commit/45999ba4ee1b2dcb12b4a2fa2cedfb6b5d66fac2", "https://github.com/pterodactyl/panel/releases/tag/v1.6.3"], "fixes": ["1.6.3"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2021-41129", "noindex": false, "published": "2021-10-06T20:05:11.000Z", "modified": "2024-08-04T02:59:31.602Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01752, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2021-41129", "title": "Authentication bypass in Pterodactyl", "description": "Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmation_token` input during the two-factor authentication process to reference a cache value not associated with the login attempt. In rare cases this can allow a malicious actor to authenticate as a random user in the Panel. The malicious user must target an account with two-factor authentication enabled, and then must provide a correct two-factor authentication token before being authenticated as that user. Due to a validation flaw in the logic handling user authentication during the two-factor auth", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-5vfx-8w6m-h3v4", "https://github.com/pterodactyl/panel/commit/4a84c36009be10dbd83051ac1771662c056e4977", "https://github.com/pterodactyl/panel/blob/v1.6.2/CHANGELOG.md#v162"], "fixes": ["1.6.2"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "GHSA-5822-pw57-vv37", "noindex": false, "published": "2020-10-08T20:13:19Z", "modified": "2024-12-02T05:28:39.721209Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-5822-pw57-vv37", "title": "XSS vulnerability when listing users on add & modify server pages.", "description": "### Impact\nAn XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server.\n\n### Patches\nThis XSS has been addressed in 0.7.19 and will be rolled forwards into the 1.0-rc.7 release.\n\n### Workarounds\nNo workaround exists without manual patching. See https://github.com/pterodactyl/panel/pull/2441/files for the files changed.\n\n### For more information\nIf you have any questions or comments about this advisory please reach out on Discord, or by emailing `dane` at `pterodactyl` dot", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-5822-pw57-vv37", "https://github.com/pterodactyl/panel", "https://osv.dev/vulnerability/GHSA-5822-pw57-vv37"], "fixes": ["0.7.19", "1.0.0-rc.7"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}, {"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}, {"id": "CVE-2019-1020002", "noindex": false, "published": "2019-07-29T14:25:23.000Z", "modified": "2024-08-05T03:14:15.311Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.01475, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2019-1020002", "title": "CVE-2019-1020002", "description": "Pterodactyl before 0.7.14 with 2FA allows credential sniffing.", "references": ["https://github.com/pterodactyl/panel/security/advisories/GHSA-vcm9-hx3q-qwj8", "https://nvd.nist.gov/vuln/detail/CVE-2019-1020002"], "fixes": ["0.7.14"], "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}]}], "total": 19, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "pterodactyl/panel", "path": "vulns/packagist/pterodactyl%2Fpanel", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-10T03:50:49.955127898Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}