PT-2026-26575 · Unknown · Game Management Panel/Billing System

Thenoname-Gurl · Publicado 2026-03-20 · Atualizado 2026-03-20 · CVE-2026-33061

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions exactyl versions after 025e8dbb0daaa04054276bda814d922cf4af58da through e28edb204e80efab628d1241198ea4f079779cfd

Description The software is a customizable game management panel and billing system. A flaw exists where server-side objects are injected into client-side JavaScript through the 'resources/views/templates/wrapper.blade.php' file. The use of unescaped json encode() without secure encoding flags allows string values to escape the JavaScript context and be interpreted as HTML or JavaScript by the browser. If serialized fields contain attacker-controlled content, such as a username, display name, or site configuration value, a malicious payload can execute arbitrary script for any user viewing the page, resulting in stored DOM-based Cross-Site Scripting (XSS).

Recommendations Update to a version after e28edb204e80efab628d1241198ea4f079779cfd.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-33061

GHSA-6XGW-MMMV-57H2

Produtos afetados

Game Management Panel/Billing System

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33061.json · Exploit
• 🔥 https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2 · Exploit
• https://github.com/Jexactyl/Jexactyl/commit/e28edb204e80efab628d1241198ea4f079779cfd · Correção
• https://twitter.com/cyberbivash/status/2034921276955865430 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33061 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33061 · Aviso do Fabricante