CVE-2018-18548

MEDIUM

AjentiCP < 1.2.23.13 - Cross-Site Scripting via File Manager Filename

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-18548. PoCs published by Numan OZDEMIR.

AI-analyzed exploit summary This is a writeup describing a stored XSS vulnerability in AjentiCP up to version 1.2.23.13. The exploit involves creating a directory with a malicious name containing JavaScript code, which executes when accessed via the File Manager tool.

Description

ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.

Exploits (1)

exploitdb WRITEUP
by Numan OZDEMIR · textwebappsphp
https://www.exploit-db.com/exploits/45691

This is a writeup describing a stored XSS vulnerability in AjentiCP up to version 1.2.23.13. The exploit involves creating a directory with a malicious name containing JavaScript code, which executes when accessed via the File Manager tool.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: AjentiCP up to v1.2.23.13
No auth needed
Prerequisites: Ability to create a directory on the target system
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://numanozdemir.com/ajenti-xss.txt
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45691/

Scores

CVSS v3 6.1
EPSS 0.0224
EPSS Percentile 85.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
ajenti/ajenticp < 1.2.23.13
pypi/ajenti 0PyPI
Published Oct 24, 2018
Tracked Since Feb 18, 2026