Control-Webpanel · weakness class

SQL Injection

5 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Connect AI

check available: 1
likely to be exploited: 1

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

CentOS Web Panel - SQL InjectionCVE-2021-31316Control-Webpanel · 13% likely
CWE-89
CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php term parameter.CVE-2020-10230Control-Webpanel · 16% likely
CWE-89
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes ParameterCVE-2026-57517Control Web Panel · CVSS 9.8 · 1.0% likelycovered by CyberSIXT
CWE-89
Control Web Panel (CWP) < 1.16 SQL Injection via access_token() APICVE-2026-77879Control Web Panel · CVSS 7.1 · 0.2% likelycovered by CyberSIXT
CWE-89 1 article
Control Web Panel (CWP) < 1.29 Blind SQL Injection via user ParameterCVE-2026-77881Control Web Panel · CVSS 5.5 · 0.2% likelycovered by CyberSIXT
CWE-89 1 article

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.