{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/control-web-panel--1.16/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-73695"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Control Web Panel (\u003c 1.16)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eControl Web Panel (CWP) before version 1.16 contains a path traversal vulnerability in services/users/index.php. By supplying an unsanitized module name parameter, which is concatenated into an include path, attackers can use directory traversal sequences to include arbitrary local PHP files and execute arbitrary PHP code in the user panel context.\u003c/p\u003e\n","date_modified":"2026-11-02T21:51:12Z","date_published":"2026-11-02T21:51:12Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cwp-lfi/","summary":"Control Web Panel (CWP) before version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files.","title":"Control Web Panel: Path traversal local file inclusion (CVE-2026-73695)","url":"https://feed.craftedsignal.io/briefs/2026-11-cwp-lfi/"}],"language":"en","title":"CraftedSignal Threat Feed - Control Web Panel (\u003c 1.16)","version":"https://jsonfeed.org/version/1.1"}