CVE-2026-50980

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record

Published 2026-08-28. Last modified 2026-09-09.