MEDIUM 6.9 NVD
CVE-2026-77881
Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQ
Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents.
References
- https://control-webpanel.com/changelog
- https://www.vulncheck.com/advisories/control-web-panel-cwp-blind-sql-injection-via-user-pa
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-11-02 via NVD.
vulnfeed aggregates 17991 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.