Threats tagged 'ghsa-36qx-jxpf-r368'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
High	8.6	CVE-2026-77880Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback High8.62026-11-02GCVE DatabaseCVE-2026-77880 Control Web Panel (CWP) versions prior to 1.16 contain an OS command injection vulnerability in the loopback API password change route (/newpass/). This flaw allows an unauthenticated attacker to inject arbitrary operating system commands via the POST 'user' parameter, which is passed unescaped to a shell command running with root privileges, enabling remote code execution as root. Report on CVE-2026-77880 Vulnerability CWE-78 #ghsa-36qx-jxpf-r368	GCVE Database	2026-11-02

Page 1 of 1