CVE-2026-77881: Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter
Vendor fix available · Affected: Control Web Panel · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 8% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Weakness
- SQL Injection
- Vendor
- Control Web Panel
- Published
- November 2026
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 5 Nov.
- Control Web Panel flaws chain to unauthenticated root accessSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.