Advisories · Technology

Control Web Panel.

Every CVE that names Control Web Panel among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-104080 CVE record

CVSS 8.5 High

Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token
- Control Web Panel
- Command injection
Not analysed yet 2 Nov 2026
CVE-2026-77881 CVE record

CVSS 6.8 Medium

Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter
- Control Web Panel
- SQL injection
Not analysed yet 2 Nov 2026
CVE-2026-77880 CVE record

CVSS 8.5 High

Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/
- Control Web Panel
- Command injection
Not analysed yet 2 Nov 2026
CVE-2026-77879 CVE record

CVSS 8.4 High

Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API
- Control Web Panel
- SQL injection
Not analysed yet 2 Nov 2026
CVE-2026-77878 CVE record

CVSS 8.5 High

Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API
- Control Web Panel
- Command injection
Not analysed yet 2 Nov 2026
CVE-2026-77877 CVE record

CVSS 8.5 High

Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access
- Control Web Panel
- Authentication bypass
Not analysed yet 2 Nov 2026
CVE-2026-77876 CVE record

CVSS 8.7 High

Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory
- Control Web Panel
- Command injection
Not analysed yet 2 Nov 2026
CVE-2026-73697 CVE record

CVSS 8.7 High

Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
- Control Web Panel
- Path traversal
- Command injection
Not analysed yet 2 Nov 2026
CVE-2026-73696 CVE record

CVSS 8.6 High

Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex
- Control Web Panel
- CWE-698
Not analysed yet 2 Nov 2026
CVE-2026-73695 CVE record

CVSS 8.7 High

Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php
- Control Web Panel
- File inclusion
Not analysed yet 2 Nov 2026
CVE-2026-57517 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
- Control Web Panel
- SQL injection
Not analysed yet 1 Jul 2026
CVE-2023-42123 CVE record

CVSS 8.8 High

Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability
- Control Web Panel
- Command injection
Not analysed yet 3 May 2024
CVE-2023-42122 CVE record

CVSS 7.8 High

Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability
- Control Web Panel
- Command injection
Not analysed yet 3 May 2024
CVE-2023-42121 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Control Web Panel Missing Authentication Remote Code Execution Vulnerability
- Control Web Panel
- Authentication bypass
Not analysed yet 3 May 2024
CVE-2023-42120 CVE record

CVSS 8.8 High

Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability
- Control Web Panel
- Command injection
Not analysed yet 3 May 2024