CVE

CVE-2021-45467

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Updated Nov 7, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2021-45467 Scanner

CVE-2021-45467 Scanner - Local File Inclusion (LFI) vulnerability in Control Web Panel (CWP)

Used 2.8k times · 4.2k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →