Control Web Panel vulnerabilities
We track 16 vulnerabilities in Control Web Panel products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Control Web Panel vulnerabilities
- 8.1 High severity
Control Web Panel: Incorrect Authorization
Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remo
- 8.1 High severity
Control Web Panel: Weak Password Recovery Mechanism for Forgotten Password
Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token gen
- 7.8 High severity
Control Web Panel: Improper Neutralization of Special Elements used in an OS Command
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter
- 7.1 High severity
Control Web Panel: Improper Neutralization of Special Elements used in an SQL Command
Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers c
- 7.8 High severity
Control Web Panel: Improper Neutralization of Special Elements used in an OS Command
Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body
- 7.8 High severity
Control Web Panel: Missing Authentication for Critical Functionality
Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endp
- 8.8 High severity
Control Web Panel: Improper Neutralization of Special Elements used in an OS Command
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter i
- 7.8 High severity
Control Web Panel: Improper Neutralization of Special Elements used in an OS Command
Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the u
- 8.8 High severity
Control Web Panel: Improper Limitation of a Pathname to a Restricted Directory
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrar
- 8.1 High severity
Control Web Panel: Execution After Redirect (EAR)
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call afte
- 8.8 High severity
Control Web Panel: Improper Control of Filename for Include/Require Statement in PHP Program
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an
- 9.8 Critical severity
Control Web Panel: Improper Neutralization of Special Elements used in an SQL Command
Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers ca
- 8.8 High severity
Control Web Panel: Improper Neutralization of Special Elements used in an OS Command
Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability
- 7.8 High severity
Control Web Panel: Improper Neutralization of Special Elements used in an OS Command
Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-priv
- 9.8 Critical severity
Control Web Panel: Missing Authentication for Critical Functionality
Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is not required to exploit this vulnerability. The
- 8.8 High severity
Control Web Panel: Improper Neutralization of Special Elements used in an OS Command
Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerabili