https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-03T20:08:01.514836+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-77878 CVE-2026-77878 — Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API 2026-11-03T20:08:01.515714+00:00

Affected: Control Web Panel

Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.