PT-2025-45570

CVE-2025-12914

Published

2025-11-08

Updated

2025-12-02

Description by

CVSS 2.0

5.8

Medium

MetricsAV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.1.1

Description A SQL injection issue exists in aaPanel BaoTa. The issue is located in the Backend component, specifically within the /database?action=GetDatabaseAccess endpoint. Manipulation of the Name parameter can lead to SQL injection. The exploit has been publicly disclosed. The vendor was notified but did not respond.

Recommendations Update aaPanel BaoTa to version 11.1.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers