CVE-2026-77881 Control Web Panel (CWP) < 1.30 Blind SQL Injection via user Parameter

Control Web Panel CWP before webpanelversion 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...