CVE-2026-77881

Control Web Panel (CWP) versions before webpanel_version 1.30 are vulnerable to a blind SQL injection via a 'user' parameter. The flaw exists in an unauthenticated loopback API route (originally /user_panel_dashboard/, later /valid_token/) where the parameter is directly interpolated into a query...