Control Web Panel

Records96All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical38CVSS 9.0–10.0

CVSS high32CVSS 7.0–8.9

Exploited now

Control Web Panel records in CISA KEV

TI-2025-30935 CWP Control Web Panel OS Command Injection Vulnerability CRITICAL 98KEV 2025-11-04 TI-2022-22082 CWP Control Web Panel OS Command Injection Vulnerability CRITICAL 100KEV 2023-01-17

Components

Products in the NVD configurations · select one to filter the records

Webpanel 85 records CRITICAL

Records

96 records

TI-2022-22082 CVE-2022-44877 · GHSA-fxw7-8r5q-w2v4

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147…

CRITICAL 100KEV

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99995 Published 2023-01-05 No fix listed CWE-78

TI-2025-30935 CVE-2025-48703 · GHSA-vx2w-cj7g-8hcf

OS command injection in CentOS Web Panel

CRITICAL 98KEV

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.99655 Published 2025-09-19 Fixed in 0.9.8.1205 CWE-78

TI-2021-20554 CVE-2021-45467 · GHSA-4xcw-rcp3-wq4p

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated…

CRITICAL 86

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.70745 Published 2022-12-26 No fix listed CWE-862

TI-2021-20553 CVE-2021-45466 · GHSA-cmwh-95wf-h584

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make…

HIGH 82

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.55338 Published 2022-12-26 No fix listed CWE-863

TI-2026-41408 CVE-2026-57517 · GHSA-pc6r-ch59-5926

Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter

HIGH 81

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST para…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00963 Published 2026-07-01 Fixed in 0.9.8.1225 CWE-89

TI-2022-08811 CVE-2022-25046 · GHSA-5jpv-ccxq-q87r

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to…

HIGH 76

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.57435 Published 2022-07-07 No fix listed CWE-22

TI-2026-83871 CVE-2026-104080 · GHSA-79c3-cwrw-p52v

OS command injection in Control Web Panel via valid_token route

HIGH 72

Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by i…

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.01195 Published 2026-11-02 Fixed in 1.29 CWE-78

TI-2026-83868 CVE-2026-77879 · GHSA-hcj5-rpjg-pm72

SQL injection in Control Web Panel access_token() API

HIGH 72

Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled val…

CVSS 4.0HIGH 8.4 Local Low privileges No interaction EPSS 0.00218 Published 2026-11-02 Fixed in 1.16 CWE-89

TI-2018-12942 CVE-2018-18323 · GHSA-8r9g-67wv-ppph

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via…

HIGH 70

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&file=/../ URI.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.70736 Published 2018-10-15 No fix listed CWE-22

TI-2021-11476 CVE-2021-31324 · GHSA-3jr9-r246-qqvc

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection…

HIGH 67

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.34619 Published 2021-05-18 No fix listed CWE-78

TI-2019-10039 CVE-2019-13360 · GHSA-7f4p-87qm-rj6c

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass…

MEDIUM 63

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.2445 Published 2019-07-16 No fix listed CWE-639

TI-2020-08242 CVE-2020-10230 · GHSA-29hw-5gm3-h8fm

CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection…

MEDIUM 58

CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php term parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15791 Published 2020-03-16 No fix listed CWE-89

TI-2018-12941 CVE-2018-18322 · GHSA-vrv5-qjv3-w9hc

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell…

MEDIUM 58

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start, service_restart, service_fullstatus, or service_stop parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.15141 Published 2018-10-15 No fix listed CWE-78

TI-2022-08813 CVE-2022-25048 · GHSA-6pc6-c32g-9g4q

Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.

MEDIUM 57

Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.19826 Published 2022-07-07 No fix listed CWE-78

TI-2021-11468 CVE-2021-31316 · GHSA-jf3r-qxgj-64p2

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via…

MEDIUM 57

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.13272 Published 2021-05-18 No fix listed CWE-89

TI-2019-10224 CVE-2019-13605 · GHSA-w2h2-67gf-fg28

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote…

MEDIUM 54

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.15039 Published 2019-07-16 No fix listed CWE-639

TI-2019-10038 CVE-2019-13359 · GHSA-rvvm-phfr-4jrh

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a…

MEDIUM 54

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.

CVSS 3.0HIGH 7.5 Network Low privileges No interaction EPSS 0.25342 Published 2019-07-16 No fix listed CWE-434

TI-2023-22489 CVE-2023-42121 · GHSA-m2qh-hm8j-fx8m

Missing authentication in Control Web Panel

MEDIUM 53

Control Web Panel Missing Authentication Remote Code Execution Vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01839 Published 2024-05-03 No fix listed CWE-306

TI-2020-12298 CVE-2020-15623 · GHSA-4hcf-cp54-4wwx

This vulnerability allows remote attackers to write arbitrary files on affected…

MEDIUM 53

This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08335 Published 2020-07-28 No fix listed CWE-749

TI-2020-12290 CVE-2020-15615 · GHSA-r77p-2f23-mhhj