Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
12 vulnerabilities by Control Web Panel
GCVE-1988-2026-0365
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
[KIS-2026-12] Control Web Panel <= 0.9.8.1224 (userRes) SQL Injection Vulnerability
Summary
---------------------------------------------------------------------
Control Web Panel <= 0.9.8.1224 (userRes) SQL Injection Vulnerability
---------------------------------------------------------------------
[-] Software Link:
https://control-webpanel.com
[-] Affected Versions:
Version 0.9.8.1224 and prior versions.
[-] Vulnerability Description:
User input passed through the "userRes" POST parameter to
https://[CWP_Host]:2083/[CWP_Username]/
is not properly sanitized before being used to construct an SQL query. This
can be exploited by remote, unauthenticated attackers to carry out (blind)
SQL Injection attacks.
Successful exploitation of this vulnerability requires the attacker to know
or correctly guess the username of a valid non-root account on the affected
CWP instance.
NOTE: successful exploitation allows an unauthenticated attacker to execute
arbitrary SQL queries with the privileges of the MySQL root user. Because
this account possesses the global FILE privilege, the vulnerability can be
leveraged to write arbitrary files to writable locations on the underlying
filesystem using MySQL's file output capabilities (e.g., INTO DUMPFILE). By
writing a malicious PHP payload to the web-accessible
/usr/local/cwpsrv/var/services/roundcube/logs/ directory, an attacker might
be able to execute arbitrary PHP code remotely, resulting in full Remote
Code Execution (RCE) on the affected CWP instance with the privileges of
the 'cwpsvc' account.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-57517.php
[-] Solution:
Upgrade to version 0.9.8.1225 or later.
[-] Disclosure Timeline:
[XX/YY/2025] - Vulnerability discovered
[06/05/2026] - Version 0.9.8.1225 released, issue fixed by the vendor
[26/06/2026] - CVE identifier requested
[26/06/2026] - CVE identifier assigned
[01/07/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-57517 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-12
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
unknown
|
Relationships
analysis
GCVE-1988-2026-0365 (this record)
- related CVE-2026-57517
{
"containers": {
"cna": {
"affected": [
{
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "---------------------------------------------------------------------\nControl Web Panel \u003c= 0.9.8.1224 (userRes) SQL Injection Vulnerability\n---------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://control-webpanel.com\n\n\n[-] Affected Versions:\n\nVersion 0.9.8.1224 and prior versions.\n\n\n[-] Vulnerability Description:\n\nUser input passed through the \"userRes\" POST parameter to\nhttps://[CWP_Host]:2083/[CWP_Username]/\nis not properly sanitized before being used to construct an SQL query. This\ncan be exploited by remote, unauthenticated attackers to carry out (blind)\nSQL Injection attacks.\n\nSuccessful exploitation of this vulnerability requires the attacker to know\nor correctly guess the username of a valid non-root account on the affected\nCWP instance.\n\nNOTE: successful exploitation allows an unauthenticated attacker to execute\narbitrary SQL queries with the privileges of the MySQL root user. Because\nthis account possesses the global FILE privilege, the vulnerability can be\nleveraged to write arbitrary files to writable locations on the underlying\nfilesystem using MySQL\u0027s file output capabilities (e.g., INTO DUMPFILE). By\nwriting a malicious PHP payload to the web-accessible\n/usr/local/cwpsrv/var/services/roundcube/logs/ directory, an attacker might\nbe able to execute arbitrary PHP code remotely, resulting in full Remote\nCode Execution (RCE) on the affected CWP instance with the privileges of\nthe \u0027cwpsvc\u0027 account.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-57517.php\n\n\n[-] Solution:\n\nUpgrade to version 0.9.8.1225 or later.\n\n\n[-] Disclosure Timeline:\n\n[XX/YY/2025] - Vulnerability discovered\n[06/05/2026] - Version 0.9.8.1225 released, issue fixed by the vendor\n[26/06/2026] - CVE identifier requested\n[26/06/2026] - CVE identifier assigned\n[01/07/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-57517 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-12\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:58Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/9"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/9"
},
{
"url": "https://control-webpanel.com"
},
{
"url": "https://karmainsecurity.com/KIS-2026-12"
},
{
"url": "https://karmainsecurity.com/pocs/CVE-2026-57517.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/9"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-12] Control Web Panel \u003c= 0.9.8.1224 (userRes) SQL Injection Vulnerability",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-57517",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0365",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/9",
"automated": true,
"contentSha256": "743696f1381dc1bbfe8903f6923a3621672d1520f66afabb1e9b6051368677f1",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/9",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-01T09:49:52Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0365"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:58Z",
"dateUpdated": "2026-09-11T07:55:58Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0365"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0145
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 07:49
VLAI
EPSS
VEX
Title
[KIS-2026-12] Control Web Panel <= 0.9.8.1224 (userRes) SQL Injection Vulnerability
Summary
---------------------------------------------------------------------
Control Web Panel <= 0.9.8.1224 (userRes) SQL Injection Vulnerability
---------------------------------------------------------------------
[-] Software Link:
https://control-webpanel.com
[-] Affected Versions:
Version 0.9.8.1224 and prior versions.
[-] Vulnerability Description:
User input passed through the "userRes" POST parameter to
https://[CWP_Host]:2083/[CWP_Username]/
is not properly sanitized before being used to construct an SQL query. This
can be exploited by remote, unauthenticated attackers to carry out (blind)
SQL Injection attacks.
Successful exploitation of this vulnerability requires the attacker to know
or correctly guess the username of a valid non-root account on the affected
CWP instance.
NOTE: successful exploitation allows an unauthenticated attacker to execute
arbitrary SQL queries with the privileges of the MySQL root user. Because
this account possesses the global FILE privilege, the vulnerability can be
leveraged to write arbitrary files to writable locations on the underlying
filesystem using MySQL's file output capabilities (e.g., INTO DUMPFILE). By
writing a malicious PHP payload to the web-accessible
/usr/local/cwpsrv/var/services/roundcube/logs/ directory, an attacker might
be able to execute arbitrary PHP code remotely, resulting in full Remote
Code Execution (RCE) on the affected CWP instance with the privileges of
the 'cwpsvc' account.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-57517.php
[-] Solution:
Upgrade to version 0.9.8.1225 or later.
[-] Disclosure Timeline:
[XX/YY/2025] - Vulnerability discovered
[06/05/2026] - Version 0.9.8.1225 released, issue fixed by the vendor
[26/06/2026] - CVE identifier requested
[26/06/2026] - CVE identifier assigned
[01/07/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-57517 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-12
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "---------------------------------------------------------------------\nControl Web Panel \u003c= 0.9.8.1224 (userRes) SQL Injection Vulnerability\n---------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://control-webpanel.com\n\n\n[-] Affected Versions:\n\nVersion 0.9.8.1224 and prior versions.\n\n\n[-] Vulnerability Description:\n\nUser input passed through the \"userRes\" POST parameter to\nhttps://[CWP_Host]:2083/[CWP_Username]/\nis not properly sanitized before being used to construct an SQL query. This\ncan be exploited by remote, unauthenticated attackers to carry out (blind)\nSQL Injection attacks.\n\nSuccessful exploitation of this vulnerability requires the attacker to know\nor correctly guess the username of a valid non-root account on the affected\nCWP instance.\n\nNOTE: successful exploitation allows an unauthenticated attacker to execute\narbitrary SQL queries with the privileges of the MySQL root user. Because\nthis account possesses the global FILE privilege, the vulnerability can be\nleveraged to write arbitrary files to writable locations on the underlying\nfilesystem using MySQL\u0027s file output capabilities (e.g., INTO DUMPFILE). By\nwriting a malicious PHP payload to the web-accessible\n/usr/local/cwpsrv/var/services/roundcube/logs/ directory, an attacker might\nbe able to execute arbitrary PHP code remotely, resulting in full Remote\nCode Execution (RCE) on the affected CWP instance with the privileges of\nthe \u0027cwpsvc\u0027 account.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-57517.php\n\n\n[-] Solution:\n\nUpgrade to version 0.9.8.1225 or later.\n\n\n[-] Disclosure Timeline:\n\n[XX/YY/2025] - Vulnerability discovered\n[06/05/2026] - Version 0.9.8.1225 released, issue fixed by the vendor\n[26/06/2026] - CVE identifier requested\n[26/06/2026] - CVE identifier assigned\n[01/07/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-57517 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-12\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:49:58Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/9"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/9"
},
{
"url": "https://control-webpanel.com"
},
{
"url": "https://karmainsecurity.com/KIS-2026-12"
},
{
"url": "https://karmainsecurity.com/pocs/CVE-2026-57517.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/9"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-12] Control Web Panel \u003c= 0.9.8.1224 (userRes) SQL Injection Vulnerability",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0145",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/9",
"automated": true,
"contentSha256": "743696f1381dc1bbfe8903f6923a3621672d1520f66afabb1e9b6051368677f1",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/9",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-01T09:49:52Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:22Z",
"dateUpdated": "2026-09-11T07:49:58Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0145"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57517 (GCVE-0-2026-57517)
Vulnerability from nvd – Published: 2026-07-01 15:11 – Updated: 2026-07-02 19:30
VLAI
EPSS
VEX
Title
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
Summary
Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-01 15:52 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-12 | technical-descriptionexploit |
| https://control-webpanel.com/changelog#1773753427… | release-notespatch |
| https://www.vulncheck.com/advisories/control-web-… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Jul/9 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
0 , < 0.9.8.1225
(custom)
|
Date Public
2026-07-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57517",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T15:52:38.937356Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T15:53:01.338Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-07-02T19:30:48.040Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Jul/9"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"lessThan": "0.9.8.1225",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-07-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T15:11:35.317Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Karma(In)Security Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://karmainsecurity.com/KIS-2026-12"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://control-webpanel.com/changelog#1773753427572-9bf81bf4-f2d2"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/control-web-panel-blind-sql-injection-via-userres-parameter"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Control Web Panel \u003c 0.9.8.1225 Blind SQL Injection via userRes Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-57517",
"datePublished": "2026-07-01T15:11:35.317Z",
"dateReserved": "2026-06-24T15:58:58.537Z",
"dateUpdated": "2026-07-02T19:30:48.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-42123 (GCVE-0-2023-42123)
Vulnerability from nvd – Published: 2024-05-03 02:13 – Updated: 2024-08-02 19:16
VLAI
EPSS
VEX
Title
Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability
Summary
Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability.
The specific flaw exists within the mysql_manager module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21080.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-18 14:41 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
0.9.8.1152
|
|
| control_web_panel | control_web_panel |
Affected:
0.9.8.1152
cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:* |
Date Public
2023-09-27 22:21
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "control_web_panel",
"vendor": "control_web_panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-18T14:41:11.625452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-18T14:42:16.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:50.463Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1476",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1476/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"dateAssigned": "2023-09-06T21:25:45.512Z",
"datePublic": "2023-09-27T22:21:35.045Z",
"descriptions": [
{
"lang": "en",
"value": "Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the mysql_manager module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21080."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:13:29.824Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1476",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1476/"
}
],
"source": {
"lang": "en",
"value": "Muhammad Ikhsanudin"
},
"title": "Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-42123",
"datePublished": "2024-05-03T02:13:29.824Z",
"dateReserved": "2023-09-06T21:14:24.436Z",
"dateUpdated": "2024-08-02T19:16:50.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42122 (GCVE-0-2023-42122)
Vulnerability from nvd – Published: 2024-05-03 02:13 – Updated: 2024-08-02 19:16
VLAI
EPSS
VEX
Title
Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability
Summary
Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the cwpsrv process, which listens on the loopback interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-21079.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-18 14:36 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
0.9.8.1152
|
|
| control_web_panel | control_web_panel |
Affected:
0.9.8.1152
cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:* |
Date Public
2023-09-27 22:21
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "control_web_panel",
"vendor": "control_web_panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-18T14:36:04.407976Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-18T14:38:37.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:50.408Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1479",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1479/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"dateAssigned": "2023-09-06T21:25:45.507Z",
"datePublic": "2023-09-27T22:21:48.539Z",
"descriptions": [
{
"lang": "en",
"value": "Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the cwpsrv process, which listens on the loopback interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-21079."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:13:29.018Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1479",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1479/"
}
],
"source": {
"lang": "en",
"value": "Muhammad Ikhsanudin"
},
"title": "Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-42122",
"datePublished": "2024-05-03T02:13:29.018Z",
"dateReserved": "2023-09-06T21:14:24.436Z",
"dateUpdated": "2024-08-02T19:16:50.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42121 (GCVE-0-2023-42121)
Vulnerability from nvd – Published: 2024-05-03 02:13 – Updated: 2024-08-02 19:16
VLAI
EPSS
VEX
Title
Control Web Panel Missing Authentication Remote Code Execution Vulnerability
Summary
Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of authentication within the web interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of a valid CWP user. Was ZDI-CAN-20582.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-03 18:50 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
0.9.8.1152
|
|
| control_web_panel | control_web_panel |
Affected:
0.9.8.1152
cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:* |
Date Public
2023-09-27 22:21
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "control_web_panel",
"vendor": "control_web_panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-03T18:50:39.616889Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:25:20.349Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:50.476Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1478",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1478/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"dateAssigned": "2023-09-06T21:25:45.501Z",
"datePublic": "2023-09-27T22:21:44.348Z",
"descriptions": [
{
"lang": "en",
"value": "Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of authentication within the web interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of a valid CWP user. Was ZDI-CAN-20582."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:13:28.202Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1478",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1478/"
}
],
"source": {
"lang": "en",
"value": "Muhammad Ikhsanudin"
},
"title": "Control Web Panel Missing Authentication Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-42121",
"datePublished": "2024-05-03T02:13:28.202Z",
"dateReserved": "2023-09-06T21:14:24.436Z",
"dateUpdated": "2024-08-02T19:16:50.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42120 (GCVE-0-2023-42120)
Vulnerability from nvd – Published: 2024-05-03 02:13 – Updated: 2024-08-02 19:16
VLAI
EPSS
VEX
Title
Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability
Summary
Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability.
The specific flaw exists within the dns_zone_editor module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20581.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-03 20:52 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
0.9.8.1152
|
|
| control_web_panel | control_web_panel |
Affected:
0.9.8.1152
cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:* |
Date Public
2023-09-27 22:21
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "control_web_panel",
"vendor": "control_web_panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42120",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-03T20:52:09.317364Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:25:30.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:50.617Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1477",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1477/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"dateAssigned": "2023-09-06T21:25:45.495Z",
"datePublic": "2023-09-27T22:21:39.992Z",
"descriptions": [
{
"lang": "en",
"value": "Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the dns_zone_editor module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20581."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:13:27.486Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1477",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1477/"
}
],
"source": {
"lang": "en",
"value": "Muhammad Ikhsanudin"
},
"title": "Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-42120",
"datePublished": "2024-05-03T02:13:27.486Z",
"dateReserved": "2023-09-06T21:14:24.436Z",
"dateUpdated": "2024-08-02T19:16:50.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-57517 (GCVE-0-2026-57517)
Vulnerability from cvelistv5 – Published: 2026-07-01 15:11 – Updated: 2026-07-02 19:30
VLAI
EPSS
VEX
Title
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
Summary
Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-01 15:52 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-12 | technical-descriptionexploit |
| https://control-webpanel.com/changelog#1773753427… | release-notespatch |
| https://www.vulncheck.com/advisories/control-web-… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Jul/9 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
0 , < 0.9.8.1225
(custom)
|
Date Public
2026-07-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57517",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T15:52:38.937356Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T15:53:01.338Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-07-02T19:30:48.040Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Jul/9"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"lessThan": "0.9.8.1225",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-07-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T15:11:35.317Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Karma(In)Security Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://karmainsecurity.com/KIS-2026-12"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://control-webpanel.com/changelog#1773753427572-9bf81bf4-f2d2"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/control-web-panel-blind-sql-injection-via-userres-parameter"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Control Web Panel \u003c 0.9.8.1225 Blind SQL Injection via userRes Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-57517",
"datePublished": "2026-07-01T15:11:35.317Z",
"dateReserved": "2026-06-24T15:58:58.537Z",
"dateUpdated": "2026-07-02T19:30:48.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-42123 (GCVE-0-2023-42123)
Vulnerability from cvelistv5 – Published: 2024-05-03 02:13 – Updated: 2024-08-02 19:16
VLAI
EPSS
VEX
Title
Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability
Summary
Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability.
The specific flaw exists within the mysql_manager module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21080.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-18 14:41 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
0.9.8.1152
|
|
| control_web_panel | control_web_panel |
Affected:
0.9.8.1152
cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:* |
Date Public
2023-09-27 22:21
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "control_web_panel",
"vendor": "control_web_panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-18T14:41:11.625452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-18T14:42:16.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:50.463Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1476",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1476/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"dateAssigned": "2023-09-06T21:25:45.512Z",
"datePublic": "2023-09-27T22:21:35.045Z",
"descriptions": [
{
"lang": "en",
"value": "Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the mysql_manager module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21080."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:13:29.824Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1476",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1476/"
}
],
"source": {
"lang": "en",
"value": "Muhammad Ikhsanudin"
},
"title": "Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-42123",
"datePublished": "2024-05-03T02:13:29.824Z",
"dateReserved": "2023-09-06T21:14:24.436Z",
"dateUpdated": "2024-08-02T19:16:50.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42122 (GCVE-0-2023-42122)
Vulnerability from cvelistv5 – Published: 2024-05-03 02:13 – Updated: 2024-08-02 19:16
VLAI
EPSS
VEX
Title
Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability
Summary
Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the cwpsrv process, which listens on the loopback interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-21079.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-18 14:36 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
0.9.8.1152
|
|
| control_web_panel | control_web_panel |
Affected:
0.9.8.1152
cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:* |
Date Public
2023-09-27 22:21
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "control_web_panel",
"vendor": "control_web_panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-18T14:36:04.407976Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-18T14:38:37.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:50.408Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1479",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1479/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"dateAssigned": "2023-09-06T21:25:45.507Z",
"datePublic": "2023-09-27T22:21:48.539Z",
"descriptions": [
{
"lang": "en",
"value": "Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the cwpsrv process, which listens on the loopback interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-21079."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:13:29.018Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1479",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1479/"
}
],
"source": {
"lang": "en",
"value": "Muhammad Ikhsanudin"
},
"title": "Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-42122",
"datePublished": "2024-05-03T02:13:29.018Z",
"dateReserved": "2023-09-06T21:14:24.436Z",
"dateUpdated": "2024-08-02T19:16:50.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42121 (GCVE-0-2023-42121)
Vulnerability from cvelistv5 – Published: 2024-05-03 02:13 – Updated: 2024-08-02 19:16
VLAI
EPSS
VEX
Title
Control Web Panel Missing Authentication Remote Code Execution Vulnerability
Summary
Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of authentication within the web interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of a valid CWP user. Was ZDI-CAN-20582.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-03 18:50 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
0.9.8.1152
|
|
| control_web_panel | control_web_panel |
Affected:
0.9.8.1152
cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:* |
Date Public
2023-09-27 22:21
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "control_web_panel",
"vendor": "control_web_panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-03T18:50:39.616889Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:25:20.349Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:50.476Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1478",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1478/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"dateAssigned": "2023-09-06T21:25:45.501Z",
"datePublic": "2023-09-27T22:21:44.348Z",
"descriptions": [
{
"lang": "en",
"value": "Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of authentication within the web interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of a valid CWP user. Was ZDI-CAN-20582."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:13:28.202Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1478",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1478/"
}
],
"source": {
"lang": "en",
"value": "Muhammad Ikhsanudin"
},
"title": "Control Web Panel Missing Authentication Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-42121",
"datePublished": "2024-05-03T02:13:28.202Z",
"dateReserved": "2023-09-06T21:14:24.436Z",
"dateUpdated": "2024-08-02T19:16:50.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42120 (GCVE-0-2023-42120)
Vulnerability from cvelistv5 – Published: 2024-05-03 02:13 – Updated: 2024-08-02 19:16
VLAI
EPSS
VEX
Title
Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability
Summary
Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability.
The specific flaw exists within the dns_zone_editor module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20581.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-03 20:52 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Control Web Panel | Control Web Panel |
Affected:
0.9.8.1152
|
|
| control_web_panel | control_web_panel |
Affected:
0.9.8.1152
cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:* |
Date Public
2023-09-27 22:21
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:control_web_panel:control_web_panel:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "control_web_panel",
"vendor": "control_web_panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42120",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-03T20:52:09.317364Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:25:30.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:50.617Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1477",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1477/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Control Web Panel",
"vendor": "Control Web Panel",
"versions": [
{
"status": "affected",
"version": "0.9.8.1152"
}
]
}
],
"dateAssigned": "2023-09-06T21:25:45.495Z",
"datePublic": "2023-09-27T22:21:39.992Z",
"descriptions": [
{
"lang": "en",
"value": "Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the dns_zone_editor module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20581."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:13:27.486Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1477",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1477/"
}
],
"source": {
"lang": "en",
"value": "Muhammad Ikhsanudin"
},
"title": "Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-42120",
"datePublished": "2024-05-03T02:13:27.486Z",
"dateReserved": "2023-09-06T21:14:24.436Z",
"dateUpdated": "2024-08-02T19:16:50.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}