CVE-2026-77879
Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the…
- Risk score
- 46/100
- CVSS
- 7.7 v3.1
- Published
- 2 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.7 high
References
Original description
Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.
Last activity 2 Nov 2026. Patch Forecast updates every hour.