CVE-2026-77876 Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the protecteddirectory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can...

PT-2026-135491

Control Web Panel CWP before webpanel version 1.16 contains an OS command injection vulnerability in the protected directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers ca...