Control Web Panel Control Web Panel
15 CVEs affecting Control Web Panel Control Web Panel. Latest disclosed: 2026-11-02. Critical: 4, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77876 | Critical | 9.8 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows at… |
CVE-2026-57517 | Critical | 9.8 | 2026-07-01 | Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries… |
CVE-2023-42121 | Critical | 9.8 | 2024-05-03 | Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2026-73696 | Critical | 9.1 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) th… |
CVE-2026-73697 | High | 8.8 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel mo… |
CVE-2026-73695 | High | 8.8 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbit… |
CVE-2023-42123 | High | 8.8 | 2024-05-03 | Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2023-42120 | High | 8.8 | 2024-05-03 | Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-77880 | High | 8.4 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which… |
CVE-2026-77878 | High | 8.4 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatab… |
CVE-2026-77877 | High | 8.4 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API servi… |
CVE-2026-104080 | High | 8.4 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthe… |
CVE-2023-42122 | High | 7.8 | 2024-05-03 | Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affec… |
CVE-2026-77879 | High | 7.7 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which conne… |
CVE-2026-77881 | Medium | 6.2 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MyS… |