Adds module for Control Web Panel API Command Injection (CVE-2025-67888)#20806

Merged

msutovsky-r7 merged 8 commits intorapid7:masterfrom

JohannesLks:CVE-2025-67888

Jan 14, 2026

Commits on Dec 24, 2025

Commits on Dec 26, 2025

Commits on Jan 8, 2026

fix: - Hardcode endpoint path in send_request_cgi - Use idiomatic Ruby single-line conditional - Remove unnecessary return keyword
JohannesLks
committed
Fix:n- Use Rex::Stopwatch for time-based checkn- Change CheckCode::Appears to CheckCode::Vulnerable - Add cmd/base64 encoder in Payload hash for Unix Command target - Simplify execute_command by …
JohannesLks
committed

Commits on Jan 12, 2026

fix: architecture specification
JohannesLks
committed

Commits on Jan 13, 2026

Fix archs
msutovsky-r7
committed