Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 19:35:51 +0000 CVE-2026-77880 — Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/ https://db.gcve.eu/vuln/cve-2026-77880 <p><strong>Affected:</strong> Control Web Panel</p> <p>Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST &#39;user&#39; parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.</p> <p><strong>Affected:</strong> Control Web Panel</p> <p>Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST &#39;user&#39; parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.</p> https://db.gcve.eu/vuln/cve-2026-77880