Control Web Panel vulnerabilities

Every vulnerability this feed holds for Control Web Panel, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.

10 vulnerabilities tracked.

8.7 Control Web Panel (CWP) before webpanelversion 1.16 contains an OS command injection vulnerability in the protecteddirectory user panel… CVE-2026-77876 2 Nov 2026
8.7 Control Web Panel (CWP) before webpanelversion 1.16 contains an arbitrary file write and OS command injection vulnerability in the… CVE-2026-73697 2 Nov 2026
8.7 Control Web Panel (CWP) before webpanelversion 1.16 contains a path traversal vulnerability in services/users/index.php that allows… CVE-2026-73695 2 Nov 2026
8.6 Control Web Panel (CWP) before webpanelversion 1.12 contains an execution after redirect vulnerability in the user panel authentication… CVE-2026-73696 2 Nov 2026
8.5 Control Web Panel (CWP) before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API /validtoken/ route… CVE-2026-104080 2 Nov 2026
8.5 Control Web Panel (CWP) before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change… CVE-2026-77880 2 Nov 2026
8.5 Control Web Panel (CWP) before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API database restore… CVE-2026-77878 2 Nov 2026
8.5 Control Web Panel (CWP) before webpanelversion 1.29 contains a missing authentication vulnerability that allows attackers able to reach the… CVE-2026-77877 2 Nov 2026
8.4 Control Web Panel (CWP) before webpanelversion 1.16 contains a SQL injection vulnerability in the loopback API authentication gate… CVE-2026-77879 2 Nov 2026
6.8 Control Web Panel (CWP) before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route… CVE-2026-77881 2 Nov 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Control Web Panel is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Other vendors tracked here

Microsoft Red Hat Google n/a Apache Software Foundation Apple Linux MediaTek, Inc. FreeRDP Eclipse Foundation Dell Gitea WAVLINK vercel MONGODB vim jpadilla Huawei Unknown Oracle Corporation WSO2 AM System py-pdf Elastic