{"id":"EUVD-2025-202556","enisaUuid":"ed88eebd-5dde-3be6-937b-98c21021fcfd","description":"1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a panel-name change request; if a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows a remote attacker to change the victim’s panel name to an arbitrary value without consent.","datePublished":"Dec 10, 2025, 6:23:14 PM","dateUpdated":"Oct 8, 2026, 3:21:24 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/1Panel-dev/1Panel/releases\nhttps://1panel.pro/\nhttps://www.vulncheck.com/advisories/1panel-csrf-panel-name-modification\n","aliases":"CVE-2025-34430\nGHSA-5xpq-2vmc-5cqp\n","assigner":"VulnCheck","epss":0.21,"enisaIdProduct":[{"id":"4f1a4eb9-b070-3e3a-9efa-805efa874621","product":{"name":"1Panel","vendor":{"name":"1Panel-dev"}},"product_version":"1.10.33 ≤2.0.15"}],"enisaIdVendor":[{"id":"36d6ffd9-7e40-351d-ad92-6b91849f2288","vendor":{"name":"LXware"}}],"enisaIdVulnerability":[{"id":"0e7d60af-3618-3726-ab31-266695693337","vulnerability":{"id":"CVE-2025-34430","description":"1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a panel-name change request; if a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows a remote attacker to change the victim’s panel name to an arbitrary value without consent.","datePublished":"Dec 10, 2025, 6:23:14 PM","dateUpdated":"Oct 8, 2026, 3:21:24 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/1Panel-dev/1Panel/releases\nhttps://1panel.pro/\nhttps://www.vulncheck.com/advisories/1panel-csrf-panel-name-modification\n","enisa_id":"EUVD-2025-202556\n","assigner":"VulnCheck","epss":0.21,"dataProcessed":"Nov 8, 2026, 7:15:36 AM","vulnerabilityProduct":[{"id":"f38aeea4-5568-367c-8303-c3009b888383","product":{"name":"1Panel","vendor":{"name":"1Panel-dev"}},"product_version":"1.10.33 ≤2.0.15"}],"vulnerabilityVendor":[{"id":"850469e8-58c7-3a9b-bb3c-69c8f132e9d3","vendor":{"name":"LXware"}}]}},{"id":"c789a3f3-4506-31f5-813f-08108e78c93a","vulnerability":{"id":"GHSA-5xpq-2vmc-5cqp","description":"1Panel contains a cross-site request forgery (CSRF) vulnerability in the panel name management functionality","datePublished":"Dec 10, 2025, 9:31:32 PM","dateUpdated":"Dec 23, 2025, 4:02:16 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-34430\nhttps://1panel.pro\nhttps://github.com/1Panel-dev/1Panel\nhttps://github.com/1Panel-dev/1Panel/releases\nhttps://www.vulncheck.com/advisories/1panel-csrf-panel-name-modification\n","enisa_id":"EUVD-2025-202556\n","aliases":"GHSA-5xpq-2vmc-5cqp\nCVE-2025-34430\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:54:33 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}