CVE-2026-101007

Publié : 28 septembre 2026

Modifié : 28 septembre 2026

Score CVSS

8.4

HIGH

Description détaillée

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Références et Patchs

https://gist.github.com/zuesdevil/42ac3ee7ab5554b31784da14f175e029 https://vuldb.com/cve/CVE-2026-101007 https://vuldb.com/submit/922302 https://vuldb.com/vuln/410877 https://vuldb.com/vuln/410877/cti

Dernières Vulnérabilités

CVE-2026-95104

Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service (DoS) condition.

VOIR DÉTAILS

CVE-2026-94287

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

VOIR DÉTAILS

CVE-2026-94286

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.

VOIR DÉTAILS