CWP Control Web Panel OS Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 17/01/2023. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| webpanel | < 0.9.8.1147 | 0.9.8.1147 |
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free