GHSA-mgr9-6c2j-jxrq
NoneCVSS
—
EPSS
—
Published
Dec 30, 2025
CISA due date
—
The record
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | pterodactyl/panel | 0 | 1.12.0 |
Related vulnerabilities
- CVE-2026-26016 Wings is the server control plane for Pterodactyl, a free, open-source game server… Also affects pterodactyl/panel
- GHSA-g7vw-f8p5-c728 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API… Also affects pterodactyl/panel
- GHSA-hr7j-63v7-vj7g Pterodactyl Panel's SFTP sessions remain active after user account deletion or password… Also affects pterodactyl/panel
- GHSA-jw2v-cq5x-q68g Pterodactyl improperly locks resources allowing raced queries to create more resources… Also affects pterodactyl/panel
- CVE-2025-69198 Pterodactyl is a free, open-source game server management panel. Also affects pterodactyl/panel
- GHSA-rgmp-4873-r683 Pterodactyl TOTPs can be reused during validity window Also affects pterodactyl/panel
- GHSA-8c39-xppg-479c Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced Also affects pterodactyl/panel
- CVE-2025-69197 Pterodactyl TOTPs can be reused during validity window Also affects pterodactyl/panel