CVE-2026-104080High· 7.8▾ TwilightControl Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell me…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.2%
Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /valid_token/ route, which passes the parameter unescaped into a shell_exec() call.
control_web_panel < 1.29Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73697High· 8.8Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
CVE-2026-77880High· 7.8Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/
CVE-2026-77876High· 8.8Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory
CVE-2026-77878High· 7.8Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API
CVE-2026-77881Medium· 5.5Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter
CVE-2026-77877High· 7.8Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access