CVE-2026-77881

The record

Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents.

Affected packages

Related vulnerabilities

• CVE-2026-121731 RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated… CWE-89
• CVE-2026-121524 A flaw has been found in sumiie24 School-Management-System up to… CWE-89
• CVE-2026-121502 A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. CWE-89
• CVE-2026-45146 Chamilo LMS is an open-source learning management system. CWE-89
• CVE-2026-44265 Elo is a purely functional expression language for no-code tools. CWE-89
• CVE-2026-109594 Post-authentication Improper Neutralization of Special Elements used in an SQL Command… CWE-89
• CVE-2026-65139 NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD… CWE-89
• CVE-2026-110265 A specially crafted malformed search query could return results from outside a user's… CWE-89