EUVD-2026-115247

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

EUVD-2026-115245

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

EUVD-2026-115249

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

EUVD-2026-115243

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the protecteddirectory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can...

CVE-2026-77880

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77878

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77876

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the protecteddirectory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can...

CVE-2026-104080

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

CVE-2026-104080 Control Web Panel (CWP) < 1.30 OS Command Injection via valid_token

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

CVE-2026-104080

Control Web Panel (CWP) versions before webpanel_version 1.30 are vulnerable to an OS command injection in the loopback API /valid_token/ route. The vulnerability exists because the application fails to validate the user parameter, allowing unauthenticated attackers to inject shell metacharacters...

CVE-2026-77880 Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77880

Control Web Panel (CWP) versions before 1.16 are vulnerable to an OS command injection in the loopback API password change route /newpass/. The flaw exists because the POST user parameter is passed unescaped into a shell command that runs with root privileges . An attacker can exploit this to inj...

CVE-2026-77878 Control Web Panel (CWP) < 1.30 OS Command Injection via restoredatabase API

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77878

Control Web Panel (CWP) versions prior to webpanel_version 1.30 are vulnerable to an OS command injection vulnerability. The flaw exists in the loopback API database restore route, specifically within the restoreDBBackup() handler of the /v1/restoredatabase/ endpoint. The root cause is the failur...

CVE-2026-77876 Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the protecteddirectory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can...

CVE-2026-77876

Control Web Panel (CWP) versions prior to webpanel_version 1.16 are vulnerable to an OS command injection flaw in the protected_directory user panel module. The vulnerability exists because the application fails to sanitize input sent via the file POST parameter during the acc=deletedp action , p...

CVE-2026-73697

Control Web Panel CWP before webpanelversion 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpinieditor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands...

EUVD-2026-115229

Control Web Panel CWP before webpanelversion 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpinieditor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands...

CVE-2026-73697

Control Web Panel (CWP) versions prior to webpanel_version 1.16 are vulnerable to arbitrary file write and OS command injection within the phpini_editor user panel module. The root causes involve the acc=update action, which uses file_put_contents without path confinement to write content to arbi...

CVE-2026-94349

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command executio...