Medium severity · published Sep 28, 2026
CVE-2026-101010
aaPanel BaoTa data.py getData sql injection
4.7
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument log_type leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
BaoTa · aaPanel
11.0; 11.1; 11.2; 11.3; 11.4; 11.5; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101010
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101010
vdb-entry
https://vuldb.com/vuln/410880
signature
https://vuldb.com/vuln/410880/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101010
third-party-advisory
https://vuldb.com/submit/922675
exploit
https://gist.github.com/zuesdevil/e9760c3329b739d37f3a9dc501881384
More from BaoTa
9.1
CVE-2026-101008
aaPanel BaoTa File Merge files.py merge_split_file command injection
8.4
CVE-2026-101009
aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection
8.4
CVE-2026-101007
aaPanel BaoTa Database Backup database.py InputSql os command injection
4.7
CVE-2026-101011
aaPanel BaoTa Domain domainMod.py get_domain_status sql injection
4.7
CVE-2025-12914
aaPanel BaoTa Backend database sql injection