Threats tagged 'ghsa-m2m4-55x5-x967'

Control Web Panel (CWP) versions before 1.16 contain a critical path traversal vulnerability in the services/users/index.php file. This flaw allows an attacker to supply a crafted module name that is concatenated directly into an include path without proper sanitization, enabling local PHP file inclusion. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.