AA
Vendor
Aapanel
19
CVEs
0
On KEV
4
New 30D
Products
AA9.9
aaPanel
Aapanel
11 CVEs0 on KEV3 new
BI6.5
BillionMail
aaPanel
1 CVEs0 on KEV1 new
BA9.1
BaoTa
aaPanel
6 CVEs0 on KEV0 new
AW8.8
aapanel WP Toolkit
aapanel
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-113507 | AA aaPanel Aapanel | 5.3 | Oct 20 | aaPanel common.py GetClientIp access control |
| CVE-2026-113506 | AA aaPanel Aapanel | 9.9 | Oct 20 | aaPanel File Manager common.py ExecShell os command injection |
| CVE-2026-113505 | AA aaPanel Aapanel | 4.3 | Oct 20 | aaPanel Download Endpoint v2.py send_file path traversal |
| CVE-2026-111367 | BI BillionMail aaPanel | 6.5 | Oct 15 | BillionMail through 4.9 Forgeable JWTs via Default Signing Key |
| CVE-2026-101011 | BA BaoTa aaPanel | 4.7 | Sep 28 | aaPanel BaoTa Domain domainMod.py get_domain_status sql injection |
| CVE-2026-101010 | BA BaoTa aaPanel | 4.7 | Sep 28 | aaPanel BaoTa data.py getData sql injection |
| CVE-2026-101009 | BA BaoTa aaPanel | 8.4 | Sep 28 | aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection |
| CVE-2026-101008 | BA BaoTa aaPanel | 9.1 | Sep 28 | aaPanel BaoTa File Merge files.py merge_split_file command injection |
| CVE-2026-101007 | BA BaoTa aaPanel | 8.4 | Sep 28 | aaPanel BaoTa Database Backup database.py InputSql os command injection |
| CVE-2026-29858 | AA Aapanel Aapanel | 7.5 | Mar 18 | A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information exposure |
| CVE-2026-29856 | AA Aapanel Aapanel | 7.5 | Mar 18 | An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial of Service (ReDoS) via a crafted input |
| CVE-2026-29859 | AA Aapanel Aapanel | 9.8 | Mar 18 | An arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary code via uploading a crafted file |
| CVE-2025-12914 | BA BaoTa aaPanel | 4.7 | Nov 8 | aaPanel BaoTa Backend database sql injection |
| CVE-2025-6813 | AW aapanel WP Toolkit aapanel | 8.8 | Jul 18 | aapanel WP Toolkit 1.0 - 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via auto_login() Function |
| CVE-2024-42922 | AA Aapanel Aapanel | 6.5 | May 21 | AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability |
| CVE-2022-26252 | AA Aapanel Aapanel | 6.5 | Mar 27 | aaPanel v6.8.21 was discovered to be vulnerable to directory traversal |
| CVE-2021-37840 | AA Aapanel Aapanel | 8.8 | Aug 2 | aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured… |
| CVE-2020-14950 | AA Aapanel Aapanel | 8.8 | Jun 21 | aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request (start, stop, or… |
| CVE-2020-14421 | AA Aapanel Aapanel | 7.2 | Jun 18 | aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen |