{"vulnerability": "CVE-2021-37840", "sightings": [{"uuid": "593d6e0e-41bd-4577-bd68-1c0f1a53d79b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37840", "type": "seen", "source": "https://t.me/cibsecurity/26685", "content": "\u203c CVE-2021-37840 \u203c\n\naaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-02T18:27:30.000000Z"}, {"uuid": "8cfc52c3-05ca-4c1a-b98f-7a8af46d3284", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37840", "type": "seen", "source": "https://t.me/GithubRedTeam/90195", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a aapanel-ws-bypass\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EonSecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-23 03:33:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\naaPanel WebSocket CSRF Bypass leading to RCE (Incomplete fix for CVE-2021-37840)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:20.914675Z"}, {"uuid": "896f8ff5-85f0-4ee9-9ffb-004e8611ca54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37840", "type": "seen", "source": "https://t.me/GithubRedTeam/90195", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a aapanel-ws-bypass\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EonSecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-23 03:33:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\naaPanel WebSocket CSRF Bypass leading to RCE (Incomplete fix for CVE-2021-37840)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:36.899660Z"}, {"uuid": "64aa40cb-6dd5-477b-8294-8dd602979fa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37840", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/90195", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a aapanel-ws-bypass\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EonSecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-23 03:33:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\naaPanel WebSocket CSRF Bypass leading to RCE (Incomplete fix for CVE-2021-37840)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:19.657312Z"}]}