Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-77881Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Medium 5.5

In plain English

A medium-severity SQL injection in Control Web Panel from Control Web Panel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.2%top 91.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents.

Affected products (as reported)

Vendor	Product	Versions
Control Web Panel	Control Web Panel	0 – before 1.29

Weakness: CWE-89 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Changelog release-notes, patch
VulnCheck Blog technical-description, exploit
VulnCheck Advisory: Control Web Panel (CWP) < 1.30 Blind SQL Injection via user Parameter third-party-advisory