CVE-2026-104080

Control Web Panel (CWP) versions before webpanel_version 1.30 are vulnerable to an OS command injection in the loopback API /valid_token/ route. The vulnerability exists because the application fails to validate the user parameter, allowing unauthenticated attackers to inject shell metacharacters...

CVE-2026-104080 Control Web Panel (CWP) < 1.30 OS Command Injection via valid_token

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

EUVD-2026-115249

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...