Threats tagged 'ghsa-94wp-xcc5-c3cm'

Control Web Panel (CWP) versions before 1.16 contain an OS command injection vulnerability in the protected_directory user panel module. This flaw allows attackers to execute arbitrary operating system commands by submitting unescaped input via the file POST parameter in the acc=deletedp action. The vulnerability arises because attacker-controlled input is passed directly into a shell_exec call, enabling code execution within the user panel context.