Live › vulnerability › CVE-2026-77879
Control Web Panel (CWP) before webpanel_version 1.16 builds a MySQL query from the authorization_code and client_id parameters without escaping them. An attacker can inject SQL to read arbitrary database contents and forge the API's authentication result.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Servers running Control Web Panel before version 1.16. The flaw sits in the loopback API authentication check, which connects to MySQL as root, so the impact depends on whether that API path can be reached by an attacker. The sources do not say whether the exposure requires a particular configuration.
No product ranges from the sources yet.
webpanel_version in the panel's configuration; versions below 1.16 are listed as affected.webpanel_version 1.16 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.
This page as .md · .json · in your agent: get_signal("CVE-2026-77879")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.