Product
Control Web Panel (CWP) before version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files.