Vendors / CWP

CWP vulnerabilities being exploited

1 CWP flaw was confirmed exploited in the wild in the past 365 days, across 1 product: Control Web Panel. If you run any of them, patch these first.

Added	Exploited vulnerability	Fix by
2025-11-04	CVE-2025-48703 Control Web Panel CWP Control Web Panel OS Command Injection Vulnerability CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.	2025-11-25

Watch my CWP software Scan a website All vendors

Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.