CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-57517 — Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability...

·Source: NIST NVD

Updated:

Executive Summary

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshe

Analysis

Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account. CVSS Score: 9.8. Published: 2026-07-01T16:16:49.070.

Indicators of Compromise (1)

CVE (1)
CVE-2026-57517
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 1, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

ANCHOR-CI Framework Strengthens Partnerships and Information Sharing to Secure Critical Infrastructure

The Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) has announced the formation of the Alliance of […] The post ANCHOR-CI Framework Strengthens Partnerships and Information Sharing to Secure Critical Infrastructure appeared first on The HIPAA Journal .

HIPAA Journal
MEDIUMVulnerability

Starling to axe 130 jobs as part of automation drive

UK challenger bank Starling has announced plans to cut more than 100 jobs as part of an efficiency drive.

Finextra
MEDIUMVulnerability

ToneTag launches voice-first bank assistant for Indian market

ToneTag, India’s deep-tech platform, today announced the launch of eKosha, a voice-first business assistant for merchants that enables banks to deliver a full range of merchant banking services directly at the merchant counter without requiring new infrastructure investment.

Finextra