EUVD-2026-125801

Control Web Panel CWP before webpanelversion 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an...

libprocesshider

libprocesshider Hide a process under Linux using the ld preloader. Full tutorial available at https://sysdigcloud.com/hiding-linux-processes-for-fun-and-profit/ In short, compile the library: gianluca@sid:/libprocesshider$ make gcc -Wall -fPIC -shared -o libprocesshider.so processhider.c -ldl...

CVE-2026-104080

Control Web Panel (CWP) versions before webpanel_version 1.30 are vulnerable to an OS command injection in the loopback API /valid_token/ route. The vulnerability exists because the application fails to validate the user parameter, allowing unauthenticated attackers to inject shell metacharacters...

EUVD-2026-115249

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

CVE-2026-104080 Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token

Control Web Panel CWP before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

CVE-2026-77881 Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-77881 Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

EUVD-2026-115247

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77880

Control Web Panel (CWP) versions before 1.16 are vulnerable to an OS command injection in the loopback API password change route /newpass/. The flaw exists because the POST user parameter is passed unescaped into a shell command that runs with root privileges . An attacker can exploit this to inj...

CVE-2026-77880 Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77880 Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77879 Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API

Control Web Panel CWP before webpanelversion 1.16 contains a SQL injection vulnerability in the loopback API authentication gate accesstoken, which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorizationcode...

CVE-2026-77879

Control Web Panel (CWP) versions prior to webpanel_version 1.16 are vulnerable to a SQL injection flaw in the access_token() loopback API authentication gate. The root cause is the direct interpolation of attacker-controlled values into MySQL queries, specifically via the authorization_code and c...

CVE-2026-77878

Control Web Panel (CWP) versions prior to webpanel_version 1.30 are vulnerable to an OS command injection vulnerability. The flaw exists in the loopback API database restore route, specifically within the restoreDBBackup() handler of the /v1/restoredatabase/ endpoint. The root cause is the failur...

EUVD-2026-115245

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77878 Control Web Panel (CWP) < 1.30 OS Command Injection via restoredatabase API

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77878 Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API

Control Web Panel CWP before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77877 Control Web Panel (CWP) < 1.30 Unauthenticated Loopback API Root Access

Control Web Panel CWP before webpanelversion 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/,...

CVE-2026-77877 Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access

Control Web Panel CWP before webpanelversion 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/,...

CVE-2026-77877

Control Web Panel (CWP) versions prior to webpanel_version 1.30 are vulnerable to a missing authentication flaw in the loopback API service. This vulnerability allows an attacker who can reach the loopback API to invoke root-privileged API routes without an access token. Specific exploitable endp...