CVE-2018-18548

Ajenti Cross-site Scripting Via Filename

6.1 MediumPublic exploit

CVE-2018-18548 is a medium vulnerability (CVSS 6.1) in Ajenti Ajenticp, published October 24, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.59%, the 89th percentile. No source names a fixed version.

ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

3.59%Unchanged since Apr 14, 2021

What each source reports

NVD Score used 6.1

ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.

Record: CVE-2018-18548
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.

Record: CVE-2018-18548
Updated: 2026-11-02

EUVDEUVD-2018-0008 No score

ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.

Record: EUVD-2018-0008
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5pcv-m8w2-62m9 5.1

Ajenti Cross-site Scripting Via Filename

Ajenti through v1.2.23.13 has a Cross-site Scripting (XSS) vulnerability via a filename that is mishandled in File Manager.

Record: GHSA-5pcv-m8w2-62m9
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-5pcv-m8w2-62m9 5.1

Ajenti Cross-site Scripting Via Filename

Ajenti through v1.2.23.13 has a Cross-site Scripting (XSS) vulnerability via a filename that is mishandled in File Manager.

Record: GHSA-5pcv-m8w2-62m9
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVPYSEC-2018-107 No score

ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.

Record: PYSEC-2018-107
Updated: 2026-11-02

Affected products

ajenti ajenticp

Affected packages

Affected packages
Package	Affected	Fixed
`ajenti` PyPI	through 1.2.23.13	None known
`ajenti` PyPI	through 1.2.23.13, plus listed versions 0.99.110.99.190.99.200.99.210.99.22 Show 45 moreShow less 0.99.230.99.240.99.250.99.260.99.270.99.280.99.290.99.300.99.310.99.320.99.330.99.340.99.350.99.360.99.370.99.380.99.390.99.70.99.81.0.01.0.11.0.21.0.31.0.81.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.81.1.8.21.1.91.1.9.11.1.9.21.1.9.31.2.01.2.11.2.101.2.111.2.11.11.2.11.21.2.131.2.13.1	None known
`ajenti` PyPI	All versions, plus listed versions 0.99.110.99.190.99.200.99.210.99.22 Show 45 moreShow less 0.99.230.99.240.99.250.99.260.99.270.99.280.99.290.99.300.99.310.99.320.99.330.99.340.99.350.99.360.99.370.99.380.99.390.99.70.99.81.0.01.0.11.0.21.0.31.0.81.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.81.1.8.21.1.91.1.9.11.1.9.21.1.9.31.2.01.2.11.2.101.2.111.2.11.11.2.11.21.2.131.2.13.1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	AjentiCP 1.2.23.13 - Cross-Site Scripting	2018-10-25

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 185 versions. The JSON record has them.