Live › vulnerability › CVE-2026-77881
Control Web Panel (CWP) before 1.30 has an unauthenticated loopback API route that puts the 'user' parameter straight into a MySQL query. An attacker who can reach the route can use time-based blind SQL injection to read arbitrary database contents, which the route runs as MySQL root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Servers running Control Web Panel before webpanel_version 1.30. The flaw is in an unauthenticated route that reaches MySQL as root, so any host running an older CWP should be treated as exposed until upgraded. Hosts without CWP are not affected.
No product ranges from the sources yet.
1.30./user_panel_dashboard/ or /valid_token/ routes respond on the panel.1.30 or later (webpanel_version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents.
This page as .md · .json · in your agent: get_signal("CVE-2026-77881")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.