CVE-2026-73696High· 8.1▾ TwilightControl Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a m…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.
control_web_panel < 1.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73697High· 8.8Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
CVE-2026-104080High· 7.8Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token
CVE-2026-77881Medium· 5.5Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter
CVE-2026-77880High· 7.8Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/
CVE-2026-77879High· 7.1Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API
CVE-2026-77877High· 7.8Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access