Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Control Web Panel 1.29 Clear all filters
TI-2026-83871 CVE-2026-104080 · GHSA-79c3-cwrw-p52v

OS command injection in Control Web Panel via valid_token route

Priority HIGH 72

Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by i…

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.01195 Published 2026-11-02 Fixed in 1.29 CWE-78
TI-2026-83870 CVE-2026-77881 · GHSA-8pqv-6v86-4wxr

Blind SQL injection in Control Web Panel (CWP) via user parameter

Priority LOW 29

Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated direct…

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00191 Published 2026-11-02 Fixed in 1.29 CWE-89
TI-2026-83867 CVE-2026-77878 · GHSA-xxpw-8v5c-fcm7

OS command injection in Control Web Panel restoredatabase API

Priority MEDIUM 40

Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-…

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00848 Published 2026-11-02 Fixed in 1.29 CWE-78
TI-2026-83866 CVE-2026-77877 · GHSA-5qj9-v45f-h548

Missing authentication in Control Web Panel exposes root API routes

Priority LOW 38

Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an…

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00165 Published 2026-11-02 Fixed in 1.29 CWE-306