CVE-2025-30008: HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a do

mediumCVSS 4.6CVE-2025-30008

HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in list_dns_rec.php, allowing the payload to execute in the browser of any user who views the DNS record list, including administrators.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 4.6
Published: 2026-07-10
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-30008

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-30008	coverage & exploitation status	NVD · CVE.org

Recent advisories for HestiaCP

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2025-30007: HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows…nvd · 2026-07-10
unknownCVE-2026-12196: HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privi…nvd · 2026-07-04

CVE-2025-30008: HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a do

Details

Referenced CVEs

Recent advisories for HestiaCP

More from NVD Recent CVEs