488 matches found
CVE-2024-22198_Checker
CVE-2024-22198 - authenticated remote code execution in Nginx-ui Description This tool made for remote checking your Nginx-ui version and notify if it's vulnerable to CVE-2024-22198. Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by...
CVE-2024-49368
Nginx UI Exploit Setup This guide outlines the steps to set up Nginx UI using Docker Compose, create a user, run an exploit, and verify the results within the Docker container. Prerequisites Ensure you have Docker and Docker Compose installed on your machine. Familiarity with basic command-line...
Nginx UI <= 2.3.7 - Unauthenticated Installer Exposure
Nginx UI 2.0.0 to 2.3.8 contains an authentication bypass caused by unauthenticated access to /api/install during first-run setup, letting remote attackers claim the initial admin account, exploit requires attacker to access the service before legitimate operator. id: CVE-2026-42221 info: name:...
Nginx UI < 2.3.3 - Information Disclosure
Nginx UI 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups. id: CVE-2026-27944 info: name: Nginx UI 2.3.3 ...
Nginx UI - Broken Access Control
Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover. id: CVE-2026-33032 info: name: Nginx UI - Broken Access Control author: DhiyaneshDk severity: critical description: | Network attackers can fully control ngi...
nginx-ui-CVE-2026-42221-CVE-2026-42238-
nginx-ui CVE Verification Environment This repository is for actually verifying two CVEs reported for nginx-ui Nginx's Web GUI management tool in a Docker environment. CVE-2026-42221 : Unauthenticated administrator account takeover CVE-2026-42238 : Command execution via unauthenticated backup...
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcpmessage using only ordinary authentication. Details The HTTP configuration mutation surface is explicitly...
GHSA-VC32-4GWF-77XP Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcpmessage using only ordinary authentication. Details The HTTP configuration mutation surface is explicitly...
EUVD-2026-97907
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools...
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Summary Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again. Details GenerateShortToken creates an AuthTok...
GHSA-WQ4W-VWVQ-Q3X9 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Summary Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again. Details GenerateShortToken creates an AuthTok...
EUVD-2026-97864
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable...
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Summary config.ValidateConfigFile is the security control that blocks dangerous nginx directives js, perl, loadmodule of njs/perl modules, user root. Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directive...
EUVD-2026-97906
Nginx UI: nginx config directive denylist ValidateConfigFile is bypassable via same-line ";" separation → authenticated directive injection RCE on the official image...
GHSA-CF23-7QXJ-XMHR Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Summary config.ValidateConfigFile is the security control that blocks dangerous nginx directives js, perl, loadmodule of njs/perl modules, user root. Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directive...
GHSA-44XR-MRHH-QM78 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
Summary In the Casdoor SSO flow, the OAuth state parameter is hard-coded to settings.CasdoorSettings.Application — a value identical for every user and every login. The callback handler accepts whatever state the client sends without comparing it to anything stored in the user agent, enabling a...
EUVD-2026-97963
Nginx UI: Casdoor SSO callback uses a constant state parameter login CSRF...
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
Summary In the Casdoor SSO flow, the OAuth state parameter is hard-coded to settings.CasdoorSettings.Application — a value identical for every user and every login. The callback handler accepts whatever state the client sends without comparing it to anything stored in the user agent, enabling a...
GHSA-5V7C-XPFP-P65M Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...