Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-101010: aaPanel lets attackers run database commands remotely

CVE-2026-101010 · published 21 days ago

Summary

The aaPanel control panel (versions up to 11.8.0) contains a flaw in its data handling code that can be triggered over the network. By sending a specially crafted request, an attacker can inject commands into the database and potentially view or change data. Apply the vendor’s update or patch the affected script as soon as possible.

Original advisory text

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument log_type leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.0 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-74Injection

CWE-89SQL Injection

Timeline

Published28 Sep 2026

Updated19 Oct 2026

First seen28 Sep 2026

Sources

CVE-2026-101010 · NVD

Track software like this

Free during beta