CVE-2026-101011 - Vulnerability Details

- aaPanel BaoTa Domain domainMod.py get_domain_status sql injection

Description

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-09-28

Score: 5.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the get_domain_status function of aaPanel BaoTa’s Domain Handler, enabling an attacker to inject arbitrary SQL through the get parameter. This injection can lead to data exfiltration, data modification, or potentially higher‑privilege operations, compromising the confidentiality and integrity of the underlying database. The vulnerability is exploitable remotely via HTTP requests, making it accessible to anyone with network reach to the vulnerable service.

Affected Systems

aaPanel BaoTa versions up to 11.8.0 are affected. The specific file impacted is /www/server/panel/mod/project/domain/domainMod.py, part of the domain handling component. Users running any 11.8.0 or earlier release of the aaPanel BaoTa distribution are potentially exposed.

Risk and Exploitability

The CVSS score of 5.1 places this vulnerability in the medium impact range, and the EPSS score is presently unavailable. The exploit code has already been released publicly and can be used to launch attacks, indicating that while the exploitation probability may not be extremely high, the existence of an attacker‑ready payload elevates the immediate risk. The vulnerability is not listed in the CISA KEV catalog, yet the remote nature and public exploit warrant prompt remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

aaPanel

BaoTa

affected

Version	Status	Constraints
`11.0`	affected	—
`11.1`	affected	—
`11.2`	affected	—
`11.3`	affected	—
`11.4`	affected	—
`11.5`	affected	—
`11.6`	affected	—
`11.7`	affected	—
`11.8.0`	affected	—

No data.

Vendor Product Confidence Versions

Aapanel

Baota

95%

Version	Status	Scheme	Platform
`11.0`	affected	generic	—
`11.1`	affected	generic	—
`11.2`	affected	generic	—
`11.3`	affected	generic	—
`11.4`	affected	generic	—
`11.5`	affected	generic	—
`11.6`	affected	generic	—
`11.7`	affected	generic	—
`11.8.0`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade aaPanel BaoTa to the latest version that resolves the SQL injection in domainMod.py
If an upgrade cannot be performed immediately, restrict remote access to the Domain Handler API or firewall the service to only trusted IPs
Implement input validation or parameterized queries for the get_domain_status endpoint to eliminate unsanitized SQL injection points

Generated by OpenCVE AI on September 28, 2026 at 09:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00202.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://gist.github.com/zuesdevil/ec002a1540dd30d5e0d4a349b9f6fcbf
https://vuldb.com/cve/CVE-2026-101011
https://vuldb.com/submit/922682
https://vuldb.com/vuln/410881
https://vuldb.com/vuln/410881/cti

History

Mon, 28 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 28 Sep 2026 08:00:00 +0000

Type	Values Removed	Values Added
Description		A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title		aaPanel BaoTa Domain domainMod.py get_domain_status sql injection
First Time appeared		Aapanel Aapanel baota
Weaknesses		CWE-74 CWE-89
CPEs		cpe:2.3:a:aapanel:baota::::::::
Vendors & Products		Aapanel Aapanel baota
References		https://gist.github.com/zuesdevil/ec002a1540dd30d5e0d4a349b9f6fcbf https://vuldb.com/cve/CVE-2026-101011 https://vuldb.com/submit/922682 https://vuldb.com/vuln/410881 https://vuldb.com/vuln/410881/cti
Metrics		cvssV2_0 `{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}` cvssV3_0 `{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}` cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Aapanel Baota

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-28T07:30:15.539Z

Updated: 2026-09-28T12:52:33.948Z

Reserved: 2026-09-27T11:05:20.041Z

Link: CVE-2026-101011

Vulnrichment

Updated: 2026-09-28T12:52:29.967Z

NVD

Status : Deferred

Published: 2026-09-28T08:16:36.980

Modified: 2026-09-28T15:16:04.793

Link: CVE-2026-101011

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-28T10:15:05Z

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object