Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2026-77880

Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Control-webpanel Control Web Panel
Products
Webpanel Control Web Panel
CVE-2026-77879

Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API

Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Control-webpanel Control Web Panel
Products
Webpanel Control Web Panel
CVE-2026-73697

Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor

Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.

CVSS 4.0 · 8.7 High EPSS 1.8% KEV · Not listed
Vendors
Control-webpanel Control Web Panel
Products
Webpanel Control Web Panel
CVE-2026-57517

Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Control-webpanel Control Web Panel
Products
Webpanel Control Web Panel
CVE-2023-42123

Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability

Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability. The specific flaw exists within the mysql_manager module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21080.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Control-webpanel Control Web Panel
Products
Webpanel Control Web Panel
CVE-2023-42122

Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability

Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cwpsrv process, which listens on the loopback interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-21079.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Control-webpanel Control Web Panel
Products
Webpanel Control Web Panel
CVE-2023-42121

Control Web Panel Missing Authentication Remote Code Execution Vulnerability

Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of authentication within the web interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of a valid CWP user. Was ZDI-CAN-20582.

CVSS 3.0 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Control-webpanel Control Web Panel
Products
Webpanel Control Web Panel
CVE-2023-42120

Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability

Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability. The specific flaw exists within the dns_zone_editor module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20581.

CVSS 3.0 · 8.8 High EPSS 2.6% KEV · Not listed
Vendors
Control-webpanel Control Web Panel
Products
Webpanel Control Web Panel