CyberSec.Space Logo
Back to CVE Browser

CVE-2022-44877

🔥 Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2023-01-05
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

Affected Platforms (CPE)

📦
Control Webpanel

Webpanel

< 0.9.8.1147

References & Advisories

🔗 http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html
🔗 http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html
🔗 http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html
🔗 http://seclists.org/fulldisclosure/2023/Jan/1
🔗 https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
🔗 https://www.youtube.com/watch?v=kiLfSvc1SYY
🔗 http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html
🔗 http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html

Related Vulnerabilities

CVE-2026-660535.9

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache T...

CVE-2026-586628.7

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue af...

CVE-2026-583898.7

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thri...

CVE-2026-580236.9

Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are re...