HTB-Snapped-Writeup

HTB-Snapped-Writeup HTB Snapped — Hard Linux machine writeup. CVE-2026-27944 Nginx UI unauthenticated backup disclosure chained with CVE-2026-3888 snapd race condition LPE to achieve full system compromise. HTB: Snapped — Writeup Difficulty: Hard OS: Linux Ubuntu 24.04 Release Date: 23 Mar 2026...

CVE-2026-27944

CVE-2026-27944 POC: Nginx UI Unauthenticated Backup Download + Dashboard Access This repository contains an enhanced Proof of Concept POC exploit for CVE-2026-27944 , a critical vulnerability in Nginx UI. The vulnerability allows an unauthenticated attacker to download system backups via the...

-nginxui_discover

Nginx UI Discovery Scanner - CVE-2026-27944 Version Detector https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/threading-multi--threaded-brightgreen Author: NULL200OK A high‑performance, multi‑threaded scanner to discover...

CVE-2023-30146

CVE-2023-30146 - Assmann/HooToo Webcam Exploit - Sensitive Data Exposure Description An issue was discovered in HooToo and Assmann branded IP-Cameras. The firmware stores the administrator and user credentials in the backup in plaintext. The backup can be retrieved and decompressed without...

Cve-2026-27944-Tools-Exploit

🚀 CVE-2026-27944: Nginx UI Unauthenticated Backup Exploit 📌 Description 27944.py is an exploitation tool for CVE-2026-27944 that allows an attacker to download and decrypt Nginx UI backups without authentication. This vulnerability exists in Nginx UI versions 2.3.2 and allows access to: · User...

Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui

HTB-Snapped-Writeup HTB Snapped — Hard Linux machine writeup...

Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui

CVE-2026-27944 + CVE-2026-33032 — nginx-ui Zero-Credential RCE...

Exploit for Missing Encryption of Sensitive Data in Nginxui Nginx_Ui

CVE-2026-27944 POC: Nginx UI Unauthenticated Backup Download +...

GO-2026-4614 Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure in github.com/0xJacky/Nginx-UI

Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

Exploit for CVE-2026-27944

CVE-2026-27944 - Nginx-UI Unauthenticated Backup Download !...

GHSA-G9W5-QFFC-6762 Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure

Summary The /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data user credentials,...

Exploit for CVE-2025-11380

CVE-2025-11380 Proof of conc...

CVE-2023-53739 Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure

Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3settings.bin file and extract base64-encoded user and admin passwords witho...

PT-2025-48194

Name of the Vulnerable Software and Affected Versions Astak CM-818T3 2.4GHz wireless security surveillance cameras affected versions not specified Description The cameras have an unauthenticated configuration disclosure issue in the /web/cgi-bin/hi3510/backup.cgi endpoint. This endpoint allows...

CVE-2025-34329

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodesfiles/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates t...

CVE-2025-34329 AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Backup Upload RCE via ajaxBackupUploadFile.php

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodesfiles/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates t...

CVE-2021-4468

PLANEX CS-QP50F-ING2 smart cameras expose a configuration backup interface over HTTP that does not require authentication. A remote, unauthenticated attacker can directly retrieve a compressed configuration backup file from the device. The backup contains sensitive configuration information,...

CVE-2025-46348 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated...

CVE-2025-46348 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated...

YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

Summary The request to commence a site backup can be performed without authentication. Then these backups can also be downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create an archive and then download the archive without being...