CVE-2026-77881

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-77881 Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-77881 Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

EUVD-2026-115248

Control Web Panel CWP before webpanelversion 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-77881

Control Web Panel (CWP) versions before webpanel_version 1.30 are vulnerable to a blind SQL injection via a 'user' parameter. The flaw exists in an unauthenticated loopback API route (originally /user_panel_dashboard/, later /valid_token/) where the parameter is directly interpolated into a query...

CVE-2026-77881: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated…

Control Web Panel CWP before webpanelversion 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-86075

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in...

CVE-2026-86075: Allocation of Resources Without Limits or Throttling

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in...