Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by Control Web Panel
GCVE-1988-2026-0365
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
[KIS-2026-12] Control Web Panel <= 0.9.8.1224 (userRes) SQL Injection Vulnerability
Summary
---------------------------------------------------------------------
Control Web Panel <= 0.9.8.1224 (userRes) SQL Injection Vulnerability
---------------------------------------------------------------------
[-] Software Link:
https://control-webpanel.com
[-] Affected Versions:
Version 0.9.8.1224 and prior versions.
[-] Vulnerability Description:
User input passed through the "userRes" POST parameter to
https://[CWP_Host]:2083/[CWP_Username]/
is not properly sanitized before being used to construct an SQL query. This
can be exploited by remote, unauthenticated attackers to carry out (blind)
SQL Injection attacks.
Successful exploitation of this vulnerability requires the attacker to know
or correctly guess the username of a valid non-root account on the affected
CWP instance.
NOTE: successful exploitation allows an unauthenticated attacker to execute
arbitrary SQL queries with the privileges of the MySQL root user. Because
this account possesses the global FILE privilege, the vulnerability can be
leveraged to write arbitrary files to writable locations on the underlying
filesystem using MySQL's file output capabilities (e.g., INTO DUMPFILE). By
writing a malicious PHP payload to the web-accessible
/usr/local/cwpsrv/var/services/roundcube/logs/ directory, an attacker might
be able to execute arbitrary PHP code remotely, resulting in full Remote
Code Execution (RCE) on the affected CWP instance with the privileges of
the 'cwpsvc' account.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-57517.php
[-] Solution:
Upgrade to version 0.9.8.1225 or later.
[-] Disclosure Timeline:
[XX/YY/2025] - Vulnerability discovered
[06/05/2026] - Version 0.9.8.1225 released, issue fixed by the vendor
[26/06/2026] - CVE identifier requested
[26/06/2026] - CVE identifier assigned
[01/07/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-57517 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-12
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
unknown
|
Relationships
analysis
GCVE-1988-2026-0365 (this record)
- related CVE-2026-57517
{
"containers": {
"cna": {
"affected": [
{
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "---------------------------------------------------------------------\nControl Web Panel \u003c= 0.9.8.1224 (userRes) SQL Injection Vulnerability\n---------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://control-webpanel.com\n\n\n[-] Affected Versions:\n\nVersion 0.9.8.1224 and prior versions.\n\n\n[-] Vulnerability Description:\n\nUser input passed through the \"userRes\" POST parameter to\nhttps://[CWP_Host]:2083/[CWP_Username]/\nis not properly sanitized before being used to construct an SQL query. This\ncan be exploited by remote, unauthenticated attackers to carry out (blind)\nSQL Injection attacks.\n\nSuccessful exploitation of this vulnerability requires the attacker to know\nor correctly guess the username of a valid non-root account on the affected\nCWP instance.\n\nNOTE: successful exploitation allows an unauthenticated attacker to execute\narbitrary SQL queries with the privileges of the MySQL root user. Because\nthis account possesses the global FILE privilege, the vulnerability can be\nleveraged to write arbitrary files to writable locations on the underlying\nfilesystem using MySQL\u0027s file output capabilities (e.g., INTO DUMPFILE). By\nwriting a malicious PHP payload to the web-accessible\n/usr/local/cwpsrv/var/services/roundcube/logs/ directory, an attacker might\nbe able to execute arbitrary PHP code remotely, resulting in full Remote\nCode Execution (RCE) on the affected CWP instance with the privileges of\nthe \u0027cwpsvc\u0027 account.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-57517.php\n\n\n[-] Solution:\n\nUpgrade to version 0.9.8.1225 or later.\n\n\n[-] Disclosure Timeline:\n\n[XX/YY/2025] - Vulnerability discovered\n[06/05/2026] - Version 0.9.8.1225 released, issue fixed by the vendor\n[26/06/2026] - CVE identifier requested\n[26/06/2026] - CVE identifier assigned\n[01/07/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-57517 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-12\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:58Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/9"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/9"
},
{
"url": "https://control-webpanel.com"
},
{
"url": "https://karmainsecurity.com/KIS-2026-12"
},
{
"url": "https://karmainsecurity.com/pocs/CVE-2026-57517.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/9"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-12] Control Web Panel \u003c= 0.9.8.1224 (userRes) SQL Injection Vulnerability",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-57517",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0365",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/9",
"automated": true,
"contentSha256": "743696f1381dc1bbfe8903f6923a3621672d1520f66afabb1e9b6051368677f1",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/9",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-01T09:49:52Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0365"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:58Z",
"dateUpdated": "2026-09-11T07:55:58Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0365"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0145
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 07:49
VLAI
EPSS
VEX
Title
[KIS-2026-12] Control Web Panel <= 0.9.8.1224 (userRes) SQL Injection Vulnerability
Summary
---------------------------------------------------------------------
Control Web Panel <= 0.9.8.1224 (userRes) SQL Injection Vulnerability
---------------------------------------------------------------------
[-] Software Link:
https://control-webpanel.com
[-] Affected Versions:
Version 0.9.8.1224 and prior versions.
[-] Vulnerability Description:
User input passed through the "userRes" POST parameter to
https://[CWP_Host]:2083/[CWP_Username]/
is not properly sanitized before being used to construct an SQL query. This
can be exploited by remote, unauthenticated attackers to carry out (blind)
SQL Injection attacks.
Successful exploitation of this vulnerability requires the attacker to know
or correctly guess the username of a valid non-root account on the affected
CWP instance.
NOTE: successful exploitation allows an unauthenticated attacker to execute
arbitrary SQL queries with the privileges of the MySQL root user. Because
this account possesses the global FILE privilege, the vulnerability can be
leveraged to write arbitrary files to writable locations on the underlying
filesystem using MySQL's file output capabilities (e.g., INTO DUMPFILE). By
writing a malicious PHP payload to the web-accessible
/usr/local/cwpsrv/var/services/roundcube/logs/ directory, an attacker might
be able to execute arbitrary PHP code remotely, resulting in full Remote
Code Execution (RCE) on the affected CWP instance with the privileges of
the 'cwpsvc' account.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-57517.php
[-] Solution:
Upgrade to version 0.9.8.1225 or later.
[-] Disclosure Timeline:
[XX/YY/2025] - Vulnerability discovered
[06/05/2026] - Version 0.9.8.1225 released, issue fixed by the vendor
[26/06/2026] - CVE identifier requested
[26/06/2026] - CVE identifier assigned
[01/07/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-57517 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-12
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "---------------------------------------------------------------------\nControl Web Panel \u003c= 0.9.8.1224 (userRes) SQL Injection Vulnerability\n---------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://control-webpanel.com\n\n\n[-] Affected Versions:\n\nVersion 0.9.8.1224 and prior versions.\n\n\n[-] Vulnerability Description:\n\nUser input passed through the \"userRes\" POST parameter to\nhttps://[CWP_Host]:2083/[CWP_Username]/\nis not properly sanitized before being used to construct an SQL query. This\ncan be exploited by remote, unauthenticated attackers to carry out (blind)\nSQL Injection attacks.\n\nSuccessful exploitation of this vulnerability requires the attacker to know\nor correctly guess the username of a valid non-root account on the affected\nCWP instance.\n\nNOTE: successful exploitation allows an unauthenticated attacker to execute\narbitrary SQL queries with the privileges of the MySQL root user. Because\nthis account possesses the global FILE privilege, the vulnerability can be\nleveraged to write arbitrary files to writable locations on the underlying\nfilesystem using MySQL\u0027s file output capabilities (e.g., INTO DUMPFILE). By\nwriting a malicious PHP payload to the web-accessible\n/usr/local/cwpsrv/var/services/roundcube/logs/ directory, an attacker might\nbe able to execute arbitrary PHP code remotely, resulting in full Remote\nCode Execution (RCE) on the affected CWP instance with the privileges of\nthe \u0027cwpsvc\u0027 account.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-57517.php\n\n\n[-] Solution:\n\nUpgrade to version 0.9.8.1225 or later.\n\n\n[-] Disclosure Timeline:\n\n[XX/YY/2025] - Vulnerability discovered\n[06/05/2026] - Version 0.9.8.1225 released, issue fixed by the vendor\n[26/06/2026] - CVE identifier requested\n[26/06/2026] - CVE identifier assigned\n[01/07/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-57517 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-12\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:49:58Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/9"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/9"
},
{
"url": "https://control-webpanel.com"
},
{
"url": "https://karmainsecurity.com/KIS-2026-12"
},
{
"url": "https://karmainsecurity.com/pocs/CVE-2026-57517.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/9"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-12] Control Web Panel \u003c= 0.9.8.1224 (userRes) SQL Injection Vulnerability",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0145",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/9",
"automated": true,
"contentSha256": "743696f1381dc1bbfe8903f6923a3621672d1520f66afabb1e9b6051368677f1",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/9",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-01T09:49:52Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:22Z",
"dateUpdated": "2026-09-11T07:49:58Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0145"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}