PT-2026-26575 · Unknown · Game Management Panel/Billing System

Thenoname-Gurl · Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-33061

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions exactyl versions after 025e8dbb0daaa04054276bda814d922cf4af58da through e28edb204e80efab628d1241198ea4f079779cfd

Description The software is a customizable game management panel and billing system. A flaw exists where server-side objects are injected into client-side JavaScript through the 'resources/views/templates/wrapper.blade.php' file. The use of unescaped json encode() without secure encoding flags allows string values to escape the JavaScript context and be interpreted as HTML or JavaScript by the browser. If serialized fields contain attacker-controlled content, such as a username, display name, or site configuration value, a malicious payload can execute arbitrary script for any user viewing the page, resulting in stored DOM-based Cross-Site Scripting (XSS).

Recommendations Update to a version after e28edb204e80efab628d1241198ea4f079779cfd.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33061

GHSA-6XGW-MMMV-57H2

Affected Products

Game Management Panel/Billing System

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33061.json · Exploit
• 🔥 https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2 · Exploit
• https://github.com/Jexactyl/Jexactyl/commit/e28edb204e80efab628d1241198ea4f079779cfd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33061 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33061 · Vendor Advisory
• https://twitter.com/cyberbivash/status/2034921276955865430 · Twitter Post