CVE-2026-27944

CVE-2026-27944 POC：Nginx UI 未授权备份下载与仪表盘访问 本仓库包含针对 CVE-2026-27944 的增强型概念验证（POC）漏洞利用代码，该漏洞是 Nginx UI 中的一个严重漏洞。 该漏洞允许未授权攻击者通过 /api/backup 端点下载系统备份。此外，应用程序会在 X-Backup-Security HTTP 响应头中泄露 AES-256 加密密钥和 IV，使攻击者能够轻松解密下载的备份。 该增强型 POC 自动化了完整的攻击链：下载备份、解密其内容、提取配置机密（如 Node Secret 和 JWT...

-nginxui_discover

Nginx UI 发现扫描器 - CVE-2026-27944 版本检测器 https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/threading-multi--threaded-brightgreen 作者：NULL200OK 一款高性能、多线程扫描器，用于发现 Nginx UI Web 界面、检测其版本，并识别存在 CVE‑2026‑27944（版本 ≤ 2.3.2）漏洞的实例。...

CVE-2023-30146

CVE-2023-30146 - Assmann/HooToo 网络摄像头漏洞 - 敏感数据泄露 描述 在 HooToo 和 Assmann 品牌的 IP 摄像头中发现了一个问题。固件将管理员和用户凭据以明文形式存储在备份中。备份可以在无需身份验证的情况下被检索和解压，从而使远程攻击者能够访问网络。 漏洞类型 敏感数据泄露 攻击类型 远程 影响 可能的网络入侵 背景 市场上销售的许多 IP 摄像头似乎基于海思 H35xx SoC 1。这些设备上运行的固件似乎由一家名为 Foscam（深圳市福斯康姆智能科技有限公司）的公司制造，该公司是 IP...

Cve-2026-27944-Tools-Exploit

🚀 CVE-2026-27944：Nginx UI 未授权备份漏洞利用工具 📌 描述 27944.py 是针对 CVE-2026-27944 的漏洞利用工具，允许攻击者在无需认证的情况下下载并解密 Nginx UI 的备份。 此漏洞存在于 Nginx UI 版本 2.3.2 中，可导致以下数据泄露： · 用户凭据和会话令牌 · SSL 私钥 · Nginx 配置 · 数据库文件 🔧 功能 · ✅ 从目标文件中进行批量扫描 · ✅ 单个目标漏洞利用 · ✅ 自动下载备份 · ✅ 自动解密 AES-256-CBC · ✅ 自动从备份中提取凭据 🛠️ 安装方法 git clone...

HTB-Snapped-Writeup

HTB-Snapped-Writeup HTB Snapped — 困难级 Linux 机器 writeup。CVE-2026-27944（Nginx UI 未认证备份泄露）与 CVE-2026-3888（snapd 竞态条件 LPE）链式利用，实现完全系统入侵。 HTB: Snapped — Writeup 难度： 困难 操作系统： Linux Ubuntu 24.04 发布日期： 2026年3月23日 CVE： CVE-2026-27944, CVE-2026-3888 摘要 Snapped 是一台困难级 Linux 机器，托管着一个位于 nginx 之后的静态站点，并带有 Ngin...

Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui

HTB-Snapped-Writeup HTB Snapped — Hard Linux machine writeup...

Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui

CVE-2026-27944 + CVE-2026-33032 — nginx-ui Zero-Credential RCE...

Exploit for Missing Encryption of Sensitive Data in Nginxui Nginx_Ui

CVE-2026-27944 POC: Nginx UI Unauthenticated Backup Download +...

GO-2026-4614 Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure in github.com/0xJacky/Nginx-UI

Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

Exploit for CVE-2026-27944

CVE-2026-27944 - Nginx-UI Unauthenticated Backup Download !...

GHSA-G9W5-QFFC-6762 Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure

Summary The /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data user credentials,...

Exploit for CVE-2025-11380

CVE-2025-11380 Proof of conc...

CVE-2023-53739 Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure

Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3settings.bin file and extract base64-encoded user and admin passwords witho...

PT-2025-48194

Name of the Vulnerable Software and Affected Versions Astak CM-818T3 2.4GHz wireless security surveillance cameras affected versions not specified Description The cameras have an unauthenticated configuration disclosure issue in the /web/cgi-bin/hi3510/backup.cgi endpoint. This endpoint allows...

CVE-2025-34329

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodesfiles/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates t...

CVE-2025-34329 AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.php

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodesfiles/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates t...

CVE-2021-4468

PLANEX CS-QP50F-ING2 smart cameras expose a configuration backup interface over HTTP that does not require authentication. A remote, unauthenticated attacker can directly retrieve a compressed configuration backup file from the device. The backup contains sensitive configuration information,...

CVE-2025-46348 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated...

CVE-2025-46348 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated...

YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

Summary The request to commence a site backup can be performed without authentication. Then these backups can also be downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create an archive and then download the archive without being...