Summary
generated automatically from NVD dataControl Web Panel (CWP) versions before webpanel_version 1.16 have an OS command injection flaw (CWE-78) in the protected_directory user panel module. The file POST parameter in the acc=deletedp action is passed unescaped into a shell_exec call, so an attacker can run arbitrary commands and gain code execution in the user panel context. The vulnerability has a CVSS v3.1 score of 9.8 (CRITICAL).
NVD description
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.
In-depth analysis on cveo.tech
This CVE is covered in an article: context, affected versions and published fixes.
CVSS v3.1 Score
Information
- Published
- 2 nov. 2026
- Updated
- 2 nov. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-78
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.