Storm-Breaker

Storm Breaker v3 Advanced Phishing & Social Engineering Framework with MITM Proxy, Credential Harvesting, Session Hijacking, and Browser-Based Tracking. What is Storm Breaker? Storm Breaker clones a target web page and injects capture modules camera, microphone, geolocation, device-info, form...

frieren

Frieren: The micro-framework for security gadgets Description Frieren is a framework for running security tools on OpenWrt routers and Single Board Computers SBCs. It provides a web panel with WiFi management, installable modules, an integrated terminal, and a package manager. The stack is a PHP...

CentOS Web Panel - OS Command Injection

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. id: CVE-2021-31324 info: name: CentOS Web Panel - OS Command Injection author: ritikchaddha severity: critical description: | The unprivileged user portal...

Netsweeper 4.0.5 - Default Weak Account

The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. id: CVE-2014-9614 info: name: Netsweeper 4.0.5 - Default Weak Account author: daffainfo severity: critica...

CentOS Web Panel - SQL Injection

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter. id: CVE-2021-31316 info: name: CentOS Web Panel - SQL Injection author: ritikchaddha severity: critical description: | The unprivileged user portal part of CentOS Web Pane...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution

CWP Control Web Panel 0.9.8.1205 contains a remote code execution caused by shell metacharacters in the ttotal parameter in filemanager changePerm request, letting unauthenticated attackers execute code remotely, exploit requires knowledge of a valid non-root username. id: CVE-2025-48703 info:...

CVE-2026-77881

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-77880

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77876

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the protecteddirectory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can...

CVE-2026-77877

Control Web Panel CWP before webpanelversion 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/,...

CVE-2026-77879

Control Web Panel CWP before webpanelversion 1.16 contains a SQL injection vulnerability in the loopback API authentication gate accesstoken, which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorizationcode...

CVE-2026-77878

Control Web Panel CWP before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-104080

Control Web Panel CWP before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

CVE-2026-104080

Control Web Panel (CWP) versions before webpanel_version 1.30 are vulnerable to an OS command injection in the loopback API /valid_token/ route. The vulnerability exists because the application fails to validate the user parameter, allowing unauthenticated attackers to inject shell metacharacters...

EUVD-2026-115249

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

CVE-2026-104080 Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token

Control Web Panel CWP before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

EUVD-2026-115248

Control Web Panel CWP before webpanelversion 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-77881 Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-77881 Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...