Critical severity · published Jul 1, 2026
CVE-2026-57517
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
9.8
CVSS
1%
EPSS
No
On KEV
Description
Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CW
Control Web Panel · Control Web Panel
before 0.9.8.1225 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57517
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57517
technical-description
https://karmainsecurity.com/KIS-2026-12
release-notes
https://control-webpanel.com/changelog#1773753427572-9bf81bf4-f2d2
third-party-advisory
https://www.vulncheck.com/advisories/control-web-panel-blind-sql-injection-via-userres-parameter
More from Control Web Panel
9.8
CVE-2023-42121
Control Web Panel Missing Authentication Remote Code Execution Vulnerability
8.8
CVE-2023-42123
Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability
8.8
CVE-2023-42120
Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability
7.8
CVE-2023-42122
Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability