CVE-2026-77878

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77878

Control Web Panel (CWP) versions prior to webpanel_version 1.30 are vulnerable to an OS command injection vulnerability. The flaw exists in the loopback API database restore route, specifically within the restoreDBBackup() handler of the /v1/restoredatabase/ endpoint. The root cause is the failur...

CVE-2026-77878 Control Web Panel (CWP) < 1.30 OS Command Injection via restoredatabase API

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

EUVD-2026-115245

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77878 Control Web Panel (CWP) < 1.30 OS Command Injection via restoredatabase API

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77877

Control Web Panel (CWP) versions prior to webpanel_version 1.30 are vulnerable to a missing authentication flaw in the loopback API service. This vulnerability allows an attacker who can reach the loopback API to invoke root-privileged API routes without an access token. Specific exploitable endp...

CVE-2026-77878: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API…

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

PT-2026-135493

Control Web Panel CWP before webpanel version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

NetworkServlet Restore Database Unauthorized Access

The vulnerability of the NetworkServlet.restoreDatabase function in the system for centrally managing network devices and ports of the Advantech iView platform is related to the implementation or modification of arguments. Exploiting this vulnerability could allow an attacker to gain unauthorized...

Advantech iView Parameter Injection Vulnerability

Advantech iView is a Simple Network Protocol SNMP based software from Advantech, China to manage B + B SmartWorx devices. A parameter injection vulnerability exists in Advantech iView, which originates from parameter injection in the NetworkServlet.restoreDatabase function and can be exploited by...

CVE-2025-53509

A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase. This issue requires an authenticated attacker with at least user-level privileges. An input parameter can be used directly in a command without proper sanitization, allowing arbitra...

Advantech iView parameter injection vulnerability

Advantech iView is a Simple Network Protocol SNMP based software from Advantech, China to manage B + B SmartWorx devices. A parameter injection vulnerability exists in Advantech iView, which originates from parameter injection in the NetworkServlet.restoreDatabase function and can be exploited by...

Advantech iView restoreDatabase restore_filename SQL Injection Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetworkServlet endpoint, which listens on TCP port 8080 by default. When parsing the...

Advantech iView NetworkServlet restoreDatabase Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the restoreDatabase method of the NetworkServlet class. The...