Log4jUnifi

Log4jUnifi Exploiting CVE-2021-44228 in Unifi Network Application for remote code execution and more. Another Log4j on the fire: Unifi Why? Proof of concepts for this vulnerability are scattered and have to be performed manually. This repository automates the exploitation process. See the blog po...

CVE-2026-22557-PoC

CVE-2026-22557 -- UniFi Network Application Pre-Auth Path Traversal Pre-authenticated path traversal in the UniFi Network Application guest portal /guest/s/site/login. The pageerror query parameter is passed to a resource loader without validation, allowing an unauthenticated attacker to read fil...

UniFi Network Application - Path Traversal

UniFi Network Application contains a path traversal vulnerability allowing a network attacker to access and manipulate files on the underlying system, potentially leading to account access, exploit requires network access. id: CVE-2026-22557 info: name: UniFi Network Application - Path Traversal...

CVE-2026-22557-Path-Traversal-Ubiquti-UniFi

CVE-2026-22557 Path Traversal Ubiquti UniFi Network Application This repository contains a Go-based proof-of-concept scanner for CVE-2026-22557 targeting the UniFi Network Application. The tool performs a controlled and non-destructive scan against a set of common endpoints and traversal payloads...

cve-2026-22557-unifi-detection

CVE-2026-22557 — UniFi Network Application Detection Field| Detail ---|--- CVE| CVE-2026-22557 Published| 2026-03-19 CNA| HackerOne CVSS Score| 10.0 CRITICAL Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Vendor| Ubiquiti Inc Product| UniFi Network Application Description A path traversal...

CVE-2026-22557-check

CVE-2026-22557 Vulnerability Assessment Tool Safely detect whether a UniFi Network Application controller is vulnerable to CVE-2026-22557 without causing any disruption. See the full write-up at the Bishop Fox blog. Description CVE-2026-22557 is an unauthenticated path-traversal vulnerability in...

EUVD-2026-66360

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device...

EUVD-2026-66368

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application...

CVE-2026-77541

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application...

CVE-2026-77535

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device...

CVE-2026-77541

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application...

CVE-2026-77541

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application...

CVE-2026-77535

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device...

CVE-2026-77535

CVE-2026-77535 is an Improper Input Validation vulnerability in UniFi Network Application that allows a network-based, high-privilege actor to achieve Command Injection on an adopted device. The CNA-assigned CVSS 3.1 score is 9.1 (Critical) with a Changed Scope and High impact across Confidential...

CVE-2026-77535

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device...

PT-2026-82060

Name of the Vulnerable Software and Affected Versions UniFi Network Application affected versions not specified Description An Improper Access Control issue allows a malicious actor with network access and high privileges to escalate their privileges within the application. Improper Access Contro...

PT-2026-82054

Name of the Vulnerable Software and Affected Versions UniFi Network Application affected versions not specified Description An improper input validation issue allows a malicious actor with network access and high privileges to perform command injection on an adopted device. Command injection is a...

CVE-2026-77541: Improper Access Control

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application...

CVE-2026-77535: Improper Input Validation

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device...

UniFi Network Application CVE-2026-22557 — path traversal file read

Exploits CVE-2026-22557: unauthenticated arbitrary file read through the guest portal pageerror parameter on /guest/s//wechat/sign and /login. Uses lib.protocols.http.lfi for one-shot reads or an interactive LFI shell. Pair with scanner/http/unificve202622557. Note: full OS file disclosure...