References https://vuldb.com/zh/vuln/195868 https://www.nsfocus.net/vulndb/65983 https://www.exploit-db.com/exploits/50780 https://avd.aliyun.com/detail?id=AVD-2022-26252 https://www.sentinelone.com/vulnerability-database/cve-2026-29858/ https://www.cvedetails.com/version/745301/Aapanel-Aapanel-6.7.0.html https://fenrisk.com/rce-aapanel https://www.aapanel.com/forum/d/12311-vulnerabilities-listed-in-cve-security https://feedly.com/cve/vendors/aapanel https://www.sxxdckj.com/cms/a/aaPanel-an-quan-lou-dong.html
Related VulnerabilitiesPoCccm-detect: Clear-Com Core Configuration Manager Panel - DetectPoCctrlpanel-installer: CtrlPanel Installer ExposurePoCopcache-control-panel: Opcache control Panel - Unauthenticated AccessPoCcpanel-mailman-xss: cPanel Mailman - Cross-Site ScriptingPoCCVE-2026-41940: cPanel & WHM - Authentication Bypass via Session-File CRLF InjectionPoCcPanel & WHM 权限绕过漏洞(CVE-2026-41940)PoCCVE-2024-13055: Dyn Business Panel Plugin <= 1.0.0 - Cross-Site Scripting飞致云 1Panel 未授权 设计缺陷漏洞飞致云 1Panel 身份验证缺陷漏洞dpanel /api/common/user/login 默认口令漏洞dpanel /api/app/compose/get-from-uri 文件读取漏洞(CVE-2025-53363)