https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-104080/https://vulnfeed.org/cve/CVE-2026-104080/Mon, 02 Nov 2026 15:22:17 +0000Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /valid_token/ route, which passes the parameter unescaped into a shell_exec() call.https://vulnfeed.org/cve/CVE-2026-77880/https://vulnfeed.org/cve/CVE-2026-77880/Mon, 02 Nov 2026 15:21:08 +0000Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.https://vulnfeed.org/cve/CVE-2026-77879/https://vulnfeed.org/cve/CVE-2026-77879/Mon, 02 Nov 2026 15:20:40 +0000Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.https://vulnfeed.org/cve/CVE-2026-77878/https://vulnfeed.org/cve/CVE-2026-77878/Mon, 02 Nov 2026 15:19:59 +0000Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.https://vulnfeed.org/cve/CVE-2026-77877/https://vulnfeed.org/cve/CVE-2026-77877/Mon, 02 Nov 2026 15:19:26 +0000Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.https://vulnfeed.org/cve/CVE-2026-77876/https://vulnfeed.org/cve/CVE-2026-77876/Mon, 02 Nov 2026 15:18:18 +0000Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.https://vulnfeed.org/cve/CVE-2026-73695/https://vulnfeed.org/cve/CVE-2026-73695/Mon, 02 Nov 2026 15:17:37 +0000Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename(), or traversal sanitization. An attacker can supply directory traversal sequences in the module name to include arbitrary local .php files, resulting in local PHP file inclusion.https://vulnfeed.org/cve/CVE-2026-73696/https://vulnfeed.org/cve/CVE-2026-73696/Mon, 02 Nov 2026 15:17:37 +0000Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect header without exit(), allowing PHP execution to continue and the module dispatcher include to run without authentication. Attackers with nothing more than a valid hosting username can bypass authentication to reach user-panel module code paths, enabling a pre-authentication chain to root access.https://vulnfeed.org/cve/CVE-2026-73697/https://vulnfeed.org/cve/CVE-2026-73697/Mon, 02 Nov 2026 15:17:37 +0000Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_contents with no path confinement, and the acc=addlabelphpiniadv action passes unsanitized attacker input into shell_exec without escaping. An attacker with access to the module can write arbitrary files and execute arbitrary OS commands, resulting in remote code execution.