CVE-2026-77881: Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Q: Which deployments are exposed to this issue?

Control Web Panel installations with webpanel_version earlier than 1.29 are affected. The vulnerable API route is described as unauthenticated but loopback-only, so exposure depends on whether an attacker can send requests through the local interface or otherwise reach that route.

Q: What does an attacker need to exploit it?

An attacker needs to submit crafted values in the user parameter to the unauthenticated route, identified as /user_panel_dashboard/ originally and /valid_token/ later. No user interaction is required, but the attacker must be able to reach the loopback API route.

Q: What is the potential impact of successful exploitation?

The injection is time-based blind SQL injection against the oauth_clients table, and the API connects to MySQL as root. A successful attacker can extract arbitrary database contents.

Q: What should be prioritized for remediation?

Upgrade Control Web Panel to webpanel_version 1.29 or later. Until then, restrict access to the affected loopback API route so untrusted users and processes cannot submit requests to it.

Published Nov 2, 2026

Updated

Control Web Panel (CWP) before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted requests to the unauthenticated route (originally /userpaneldashboard/, later /validtoken/) to perform time-based blind SQL injection and extract arbitrary database contents.

Event History

Nov 2, 2026

CVE Published

via MITRE·03:21 PM

Data Sourced

via MITRE·03:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Control Web Panel installations with webpanel_version earlier than 1.29 are affected. The vulnerable API route is described as unauthenticated but loopback-only, so exposure depends on whether an attacker can send requests through the local interface or otherwise reach that route.

What does an attacker need to exploit it?

An attacker needs to submit crafted values in the user parameter to the unauthenticated route, identified as /user_panel_dashboard/ originally and /valid_token/ later. No user interaction is required, but the attacker must be able to reach the loopback API route.

What is the potential impact of successful exploitation?

The injection is time-based blind SQL injection against the oauth_clients table, and the API connects to MySQL as root. A successful attacker can extract arbitrary database contents.

What should be prioritized for remediation?

Upgrade Control Web Panel to webpanel_version 1.29 or later. Until then, restrict access to the affected loopback API route so untrusted users and processes cannot submit requests to it.

CVE-2026-77881: Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the potential impact of successful exploitation?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the potential impact of successful exploitation?

What should be prioritized for remediation?