CVE-2022-44877-CWP7

CVE-2022-44877-CWP7 Control Web Panel 7 CWP7 원격 코드 실행 RCE CVE-2022-44877 비인증 저장소에 POC가 곧 업데이트될 예정입니다...

CVE-2026-57517

Control Web Panel ≤ 0.9.8.1224 — 블라인드 SQL 인젝션을 통한 원격 코드 실행 포트 2083 → userRes POST → INTO DUMPFILE → 포트 2031 웹셸 → cwpsvc 🔴 취약점 개요 CVE-2026-57517 은 Control Web PanelCWP 버전 ≤ 0.9.8.1224에서 발생하는 치명적인 사전 인증pre-authentication 블라인드 SQL 인젝션 취약점입니다. 사용자 패널 엔드포인트의 userRes POST 파라미터는 SQL 쿼리에 포함되기 전에 검증되지 않습니...

CVE-2026-57517-CWP

CVE-2026-57517 CWP 익스플로잇 이 저장소는 CVE-2026-57517과 관련된 알려진 Control Web Panel CWP 취약점 시나리오를 테스트하기 위한 Go 기반 개념 증명 도구를 포함합니다. 구현은 블라인드 SQL 인젝션 경로를 대상으로 하며, 인증된 보안 평가 목적으로 선택적 웹쉘 배포 및 명령 실행 흐름을 포함합니다. 개요 이 프로젝트는 보안 연구원 및 인증된 테스터가 다음을 수행할 수 있도록 설계되었습니다: 잠재적인 CWP 노출 탐지 통제된 환경에서 취약한 대상 호스트 테스트 조건이 충족되면 임시 ...

CVE-2025-67888

CVE-2025-67888 Control Web Panel = 0.9.8.1208 admin/index.php OS 명령 주입 취약점 영향받는 버전: 버전 0.9.8.1208 및 이전 버전. 취약점 설명: "api" 매개변수가 설정된 상태에서 "key" GET 매개변수를 통해 /admin/index.php로 전달되는 사용자 입력은 OS 명령을 실행하는 데 사용되기 전에 제대로 검증되지 않습니다. 이로 인해 인증되지 않은 공격자가 웹 서버에서 root 사용자의 권한으로 임의의 OS 명령을 주입하고 실행할 수 있습니다. 이 취약점...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

CentOS-Control-Web-Panel-CVE

CentOS Control Web Panel 버전 0.9.8.836 - 0.9.8.847 2019년 6월 29일, 우리 팀은 CentOS Control Web PanelCWP 버전 0.9.8.836에서 취약점을 찾기 시작했고, 몇 가지 치명적인 취약점을 발견했습니다. 우리가 발견한 취약점 중 일부는 익명 사용자에서 루트 사용자까지 연쇄적으로 연결하여 서버를 장악할 수 있습니다. 우리 팀이 CWP에 보고한 후, 그들은 신속하게 응답했습니다. 마지막으로, 여기에 언급된 모든 취약점은 CWP 버전...

CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution

CWP Control Web Panel 0.9.8.1205 contains a remote code execution caused by shell metacharacters in the ttotal parameter in filemanager changePerm request, letting unauthenticated attackers execute code remotely, exploit requires knowledge of a valid non-root username. id: CVE-2025-48703 info:...

Exploit for CVE-2026-57517

Control Web Panel 0.9.8.1224 — Blind SQL Injection to Remot...

CVE-2026-57517

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges...

CVE-2026-57517 Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges...

CVE-2026-57517 Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges...

CVE-2026-57517

Control Web Panel prior to version 0.9.8.1225 is affected by CVE-2026-57517, a blind SQL injection via the userRes POST parameter at the user endpoint. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially leveraging MySQL root privileges obtained...

CVE-2026-57517

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges...

PT-2026-54885

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 0.9.8.1225 Description An unauthenticated remote attacker can execute arbitrary SQL queries due to improper input validation and unsafe SQL query construction. Approximately 896,400 devices worldwide are...

📄 Control Web Panel 0.9.8.1224 SQL Injection

Control Web Panel versions 0.9.8.1224 and below suffer from a remote SQL injection vulnerability via the userRes POST parameter. --------------------------------------------------------------------- Control Web Panel = 0.9.8.1224 userRes SQL Injection Vulnerability...

CVE-2026-57517: Improper Neutralization of Special Elements used in an SQL Command

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges...

CVE-2025-67888

An issue was discovered in Control Web Panel CWP before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php when the "api" parameter is set is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject an...

EUVD-2025-209736

An issue was discovered in Control Web Panel CWP before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php when the "api" parameter is set is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject an...

CVE-2025-67888

An issue was discovered in Control Web Panel CWP before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php when the "api" parameter is set is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject an...

CVE-2025-67888

An issue was discovered in Control Web Panel CWP before 0.9.8.1209. User input passed via the "key" GET parameter to /admin/index.php when the "api" parameter is set is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject an...