CVE-2025-67888 - Vulnerability Analysis
HighCVSS: 7.3Last Updated: May 8, 2026
Control Web Panel - Command Injection
Published: May 8, 2026Updated: May 8, 2026PoC AvailableRemote Exploitable
Overview
Control Web Panel (CWP) < 0.9.8.1209 contains a command injection caused by improper sanitization of the "key" GET parameter in /admin/index.php when "api" parameter is set, letting unauthenticated attackers execute arbitrary OS commands as root, exploit requires Softaculous or SitePad presence.
Severity & Score
Severity: High
CVSS Score: 7.3
Impact
Unauthenticated attackers can execute arbitrary OS commands as root, leading to full system compromise.
Mitigation
Update to version 0.9.8.1209 or later.
References
Related Resources
Details
- CVE ID
- CVE-2025-67888
- Severity
- High
- CVSS Score
- 7.3
- Type
- command_injection
- Status
- unconfirmed
CWE
- CWE-78
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L