476 matches found
CVE-2024-22198_Checker
CVE-2024-22198 - authenticated remote code execution in Nginx-ui Description This tool made for remote checking your Nginx-ui version and notify if it's vulnerable to CVE-2024-22198. Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by...
CVE-2024-49368
Nginx UI Exploit Setup This guide outlines the steps to set up Nginx UI using Docker Compose, create a user, run an exploit, and verify the results within the Docker container. Prerequisites Ensure you have Docker and Docker Compose installed on your machine. Familiarity with basic command-line...
Nginx UI - Broken Access Control
Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover. id: CVE-2026-33032 info: name: Nginx UI - Broken Access Control author: DhiyaneshDk severity: critical description: | Network attackers can fully control ngi...
Nginx UI < 2.3.3 - Information Disclosure
Nginx UI 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups. id: CVE-2026-27944 info: name: Nginx UI 2.3.3 ...
Nginx UI <= 2.3.7 - Unauthenticated Installer Exposure
Nginx UI 2.0.0 to 2.3.8 contains an authentication bypass caused by unauthenticated access to /api/install during first-run setup, letting remote attackers claim the initial admin account, exploit requires attacker to access the service before legitimate operator. id: CVE-2026-42221 info: name:...
nginx-ui-CVE-2026-42221-CVE-2026-42238-
nginx-ui CVE Verification Environment This repository is for actually verifying two CVEs reported for nginx-ui Nginx's Web GUI management tool in a Docker environment. CVE-2026-42221 : Unauthenticated administrator account takeover CVE-2026-42238 : Command execution via unauthenticated backup...
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcpmessage using only ordinary authentication. Details The HTTP configuration mutation surface is explicitly...
EUVD-2026-97907
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools...
GHSA-VC32-4GWF-77XP Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Summary An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcpmessage using only ordinary authentication. Details The HTTP configuration mutation surface is explicitly...
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Summary Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again. Details GenerateShortToken creates an AuthTok...
GHSA-WQ4W-VWVQ-Q3X9 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Summary Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again. Details GenerateShortToken creates an AuthTok...
EUVD-2026-97864
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable...
GHSA-CF23-7QXJ-XMHR Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Summary config.ValidateConfigFile is the security control that blocks dangerous nginx directives js, perl, loadmodule of njs/perl modules, user root. Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directive...
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Summary config.ValidateConfigFile is the security control that blocks dangerous nginx directives js, perl, loadmodule of njs/perl modules, user root. Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directive...
EUVD-2026-97906
Nginx UI: nginx config directive denylist ValidateConfigFile is bypassable via same-line ";" separation → authenticated directive injection RCE on the official image...
EUVD-2026-97963
Nginx UI: Casdoor SSO callback uses a constant state parameter login CSRF...
GHSA-44XR-MRHH-QM78 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
Summary In the Casdoor SSO flow, the OAuth state parameter is hard-coded to settings.CasdoorSettings.Application — a value identical for every user and every login. The callback handler accepts whatever state the client sends without comparing it to anything stored in the user agent, enabling a...
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
Summary In the Casdoor SSO flow, the OAuth state parameter is hard-coded to settings.CasdoorSettings.Application — a value identical for every user and every login. The callback handler accepts whatever state the client sends without comparing it to anything stored in the user agent, enabling a...
GHSA-5V7C-XPFP-P65M Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...