Nginx UI < 2.3.3 - Information Disclosure

Nginx UI 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups. id: CVE-2026-27944 info: name: Nginx UI 2.3.3 ...

CVE-2026-27944

CVE-2026-27944 POC：Nginx UI 未授权备份下载与仪表盘访问 本仓库包含针对 CVE-2026-27944 的增强型概念验证（POC）漏洞利用代码，该漏洞是 Nginx UI 中的一个严重漏洞。 该漏洞允许未授权攻击者通过 /api/backup 端点下载系统备份。此外，应用程序会在 X-Backup-Security HTTP 响应头中泄露 AES-256 加密密钥和 IV，使攻击者能够轻松解密下载的备份。 该增强型 POC 自动化了完整的攻击链：下载备份、解密其内容、提取配置机密（如 Node Secret 和 JWT...

CVE-2026-33032-nginx-ui-vuln-lab

CVE-2026-27944 + CVE-2026-33032 — nginx-ui 零凭证 RCE 实验环境 免责声明： 本仓库仅用于教育和授权安全研究目的。此处演示的所有技术只能用于您拥有或已获得明确书面许可进行测试的系统。作者对滥用行为不承担任何责任。未经授权，请勿对任何系统运行此工具。 一个自包含的 Docker Compose 实验环境，演示针对 nginx-ui v2.3.1 的双 CVE 漏洞链 ，可在零先验知识 的情况下实现完全接管 nginx —— 无需用户名、无需密码、无需令牌。 漏洞链 CVE-2026-27944 — 未认证备份端点 + 密钥泄露 GET...

watchTowr-vs-Splunk-CVE-2026-20253

CVE-2026-20253 Splunk Pre-Auth RCE Splunk Pre-Auth RCE 1day Detection Artifact Generator Tool Detection in Action Detection Artifact Generator attempts to access the /v1/postgres/recovery/backup endpoint of PostgreSQL Sidecar Service to verify if it is accessible or not: 400 response - probably...

CVE-2026-19971

CVE-2026-19971 affects LB-Link WR1210M firmware 1.0.3. The flaw resides in the Backup Endpoint component, specifically the /www/cgi-bin/backup.cgi main function, allowing missing authentication within the local network. In practical terms, an attacker on the same LAN could access or tamper with b...

CVE-2026-19971

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this...

CVE-2026-72738

CVE-2026-72738 affects Dokploy (self-hosted PaaS). Before v0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the user-supplied search parameter through normalizeS3Path and interpolates it into an arbirtrary command executed by child_process.exec...

CVE-2026-16088

Summary : CVE-2026-16088 affects halo-dev halo up to version 2.24.2. The vulnerability targets the Download function in MigrationEndpoint.java within the Files Backup Endpoint, where input manipulation enables path traversal. This allows remote exploitation, and public exploits have surfaced. Det...

EUVD-2026-45369

A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. Th...

CVE-2026-55885

Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, throug...

CVE-2026-55885 Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets

Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, throug...

CVE-2026-55885 Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets

Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, throug...

CVE-2026-55885

CVE-2026-55885 (Grav) : An authenticated admin with backup permissions can download a ZIP of the Grav installation via the backup/download endpoint, exposing sensitive data: admin.yaml with the administrator password hash and site configuration under user/config. The vulnerability stems from (1) ...

EUVD-2026-42944

Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, throug...

SOPlanning 跨站脚本漏洞

SOPlanning is a set of online project management software developed by SOPlanning Company. Versions of SOPlanning 1.55 and earlier had a cross-site scripting vulnerability. This vulnerability stemmed from the /process/uploadbackup endpoint, which was vulnerable to storage-based cross-site scripti...

CVE-2018-25349 userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header

userSpice 4.3.24 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the X-Forwarded-For HTTP header. Attackers can send crafted requests to the backup.php endpoint with XSS payloads in the X-Forwarded-For header that execute when administrators...

Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore

nginx-ui exposes a backup restore endpoint POST /api/restore that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites the application's configuration file...

SUSE CVE-2026-27944

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to...

VulnCheck KEV: CVE-2026-27944

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the exec.Command function via the compressionalgorithm parameter in API calls to the image and backup endpoints. An attacker can execute arbitrary commands as the LXD daemon by sending specially crafted...