CVE-2026-77880High· 7.8▾ TwilightControl Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.8%
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.
control_web_panel < 1.16Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73697High· 8.8Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
CVE-2026-104080High· 7.8Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token
CVE-2026-77876High· 8.8Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory
CVE-2026-77878High· 7.8Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API
CVE-2026-77881Medium· 5.5Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter
CVE-2026-77877High· 7.8Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access