Aapanel vulnerabilities

Products

• Aapanel 8
• Baota 7

Newest

• aapanel billionmail BillionMail through 4.9 Forgeable JWTs via Default Signing Key CVE-2026-111367 6.9 MediumOctober 15, 2026
• aapanel baota aaPanel BaoTa Domain domainMod.py get_domain_status sql injection CVE-2026-101011 5.1 MediumSeptember 28, 2026
• aapanel baota aaPanel BaoTa data.py getData sql injection CVE-2026-101010 5.1 MediumSeptember 28, 2026
• aapanel baota aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection CVE-2026-101009 9.3 CriticalSeptember 28, 2026
• aapanel baota aaPanel BaoTa File Merge files.py merge_split_file command injection CVE-2026-101008 9.4 CriticalSeptember 28, 2026
• aapanel baota aaPanel BaoTa Database Backup database.py InputSql os command injection CVE-2026-101007 9.3 CriticalSeptember 28, 2026
• aapanel An arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary... CVE-2026-29859 9.8 CriticalMarch 18, 2026
• aapanel A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion ... CVE-2026-29858 7.5 HighMarch 18, 2026
• aapanel An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows... CVE-2026-29856 7.5 HighMarch 18, 2026
• aapanel baota aaPanel BaoTa Backend database sql injection CVE-2025-12914 5.1 MediumNovember 8, 2025
• aapanel wp toolkit aapanel WP Toolkit 1.0 - 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via auto_login() Function CVE-2025-6813 8.8 HighJuly 18, 2025
• aapanel AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability. CVE-2024-42922 6.5 MediumMay 21, 2025
• aapanel baota In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain... CVE-2022-4336 5.4 MediumDecember 9, 2022
• aapanel aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows... CVE-2022-26252 6.5 MediumMarch 27, 2022
• aapanel aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within... CVE-2021-37840 Public exploit 8.8 HighAugust 2, 2021
• aapanel aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell... CVE-2020-14950 8.8 HighJune 21, 2020
• aapanel aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the... CVE-2020-14421 7.2 HighJune 18, 2020