Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Control Web Panel | Control Web Panel | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 02 Nov 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mon, 02 Nov 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context. | |
| Title | Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory | |
| First Time appeared |
Control-webpanel
Control-webpanel webpanel |
|
| Weaknesses | CWE-78 | |
| CPEs | cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Control-webpanel
Control-webpanel webpanel |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-02T15:39:37.659Z
Reserved: 2026-08-21T15:33:14.171Z
Link: CVE-2026-77876
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.