{"items":[{"id":"CVE-2026-104080","published":"2026-11-02T15:22:17.516Z","updated":"2026-11-07T00:25:45.245Z","title":"Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token","severity":"HIGH","score":8.5,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.01195,"kevAdded":null},{"id":"CVE-2026-77881","published":"2026-11-02T15:21:39.746Z","updated":"2026-11-03T17:01:24.724Z","title":"Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter","severity":"MEDIUM","score":6.8,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.00191,"kevAdded":null},{"id":"CVE-2026-77880","published":"2026-11-02T15:21:08.652Z","updated":"2026-11-03T17:01:18.914Z","title":"Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/","severity":"HIGH","score":8.5,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.00789,"kevAdded":null},{"id":"CVE-2026-77879","published":"2026-11-02T15:20:40.321Z","updated":"2026-11-07T00:24:32.378Z","title":"Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API","severity":"HIGH","score":8.4,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2026-77878","published":"2026-11-02T15:19:59.230Z","updated":"2026-11-03T17:01:06.102Z","title":"Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API","severity":"HIGH","score":8.5,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.00848,"kevAdded":null},{"id":"CVE-2026-77877","published":"2026-11-02T15:19:26.464Z","updated":"2026-11-03T17:00:59.069Z","title":"Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access","severity":"HIGH","score":8.5,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-77876","published":"2026-11-02T15:18:18.530Z","updated":"2026-11-03T17:00:50.149Z","title":"Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory","severity":"HIGH","score":8.7,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.02251,"kevAdded":null},{"id":"CVE-2026-73697","published":"2026-11-02T14:53:27.789Z","updated":"2026-11-03T17:00:41.411Z","title":"Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor","severity":"HIGH","score":8.7,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.01809,"kevAdded":null},{"id":"CVE-2026-73696","published":"2026-11-02T14:52:29.886Z","updated":"2026-11-03T17:00:32.808Z","title":"Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex","severity":"HIGH","score":8.6,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.00493,"kevAdded":null},{"id":"CVE-2026-73695","published":"2026-11-02T14:51:47.891Z","updated":"2026-11-03T17:00:18.033Z","title":"Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php","severity":"HIGH","score":8.7,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.00952,"kevAdded":null},{"id":"CVE-2026-57517","published":"2026-07-01T15:11:35.317Z","updated":"2026-10-01T19:19:24.554Z","title":"Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter","severity":"CRITICAL","score":9.3,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.00963,"kevAdded":null},{"id":"CVE-2023-42123","published":"2024-05-03T02:13:29.824Z","updated":"2024-08-02T19:16:50.463Z","title":"Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability","severity":"HIGH","score":8.8,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.02307,"kevAdded":null},{"id":"CVE-2023-42122","published":"2024-05-03T02:13:29.018Z","updated":"2024-08-02T19:16:50.408Z","title":"Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability","severity":"HIGH","score":7.8,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.00767,"kevAdded":null},{"id":"CVE-2023-42121","published":"2024-05-03T02:13:28.202Z","updated":"2024-08-02T19:16:50.476Z","title":"Control Web Panel Missing Authentication Remote Code Execution Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.01839,"kevAdded":null},{"id":"CVE-2023-42120","published":"2024-05-03T02:13:27.486Z","updated":"2024-08-02T19:16:50.617Z","title":"Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability","severity":"HIGH","score":8.8,"vendor":"Control Web Panel","product":"Control Web Panel","kev":false,"epss":0.0263,"kevAdded":null}]}