https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-104080.htmlhttps://patchthecve.com/cve/CVE-2026-104080.htmlMon, 02 Nov 2026 15:36:24 +0000HIGH 8.4: Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers chttps://patchthecve.com/cve/CVE-2026-77881.htmlhttps://patchthecve.com/cve/CVE-2026-77881.htmlMon, 02 Nov 2026 15:35:55 +0000MEDIUM 6.2: Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requhttps://patchthecve.com/cve/CVE-2026-77880.htmlhttps://patchthecve.com/cve/CVE-2026-77880.htmlMon, 02 Nov 2026 15:35:36 +0000HIGH 8.4: Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell cohttps://patchthecve.com/cve/CVE-2026-77879.htmlhttps://patchthecve.com/cve/CVE-2026-77879.htmlMon, 02 Nov 2026 15:37:40 +0000HIGH 7.7: Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_https://patchthecve.com/cve/CVE-2026-77878.htmlhttps://patchthecve.com/cve/CVE-2026-77878.htmlMon, 02 Nov 2026 15:36:58 +0000HIGH 8.4: Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escahttps://patchthecve.com/cve/CVE-2026-77877.htmlhttps://patchthecve.com/cve/CVE-2026-77877.htmlMon, 02 Nov 2026 15:38:31 +0000HIGH 8.4: Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /genhttps://patchthecve.com/cve/CVE-2026-77876.htmlhttps://patchthecve.com/cve/CVE-2026-77876.htmlMon, 02 Nov 2026 15:39:37 +0000CRITICAL 9.8: Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can