Live › vulnerability › CVE-2026-77880
Control Web Panel (CWP), a web hosting control panel, passes the POST 'user' parameter of its loopback password change route /newpass/ unescaped into a shell command. An attacker who can reach that route can run arbitrary operating system commands as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Servers running Control Web Panel before webpanel_version 1.16 are exposed. The flaw sits in a loopback-only API route, so the sources describe it as reachable from the local machine; whether a remote attacker can reach it through a proxy or other path is unknown. Teams not running CWP can skip it.
No product ranges from the sources yet.
webpanel_version below 1.16 means it is affectedwebpanel_version 1.16 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-77880")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.