CVE-2026-79314

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource...

CVE-2026-79315

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the...

CVE-2026-79314

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2 , a web-based proxy management panel. The root cause is that the update endpoint fails to verify that the target resource belongs to the requesting session user. An authenticated user can modify another user's inbound proxy conf...

EUVD-2026-84465

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the...

CVE-2026-79315

CVE-2026-79315 is a reflected cross-site scripting (XSS) vulnerability in x-ui 0.3.2 , a VPN proxy management panel. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffec...

CVE-2026-79316

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-79316

An improper access control vulnerability in x-ui 0.3.2 allows any authenticated panel user to modify the xray configuration template through the settings interface and trigger a panel restart. This causes the xray management gRPC service , which is bound to loopback by default, to be regenerated ...

CVE-2026-79317

x-ui 0.3.2 has a session invalidation flaw where the full user object is stored in a client-side signed cookie . Authentication only verifies that a user object can be retrieved from the cookie, without re-validating against the database or checking a session version. As a result, when an adminis...

3x-ui 安全漏洞

3x-ui is a software by Sanaei Personal Developers. A security vulnerability exists in versions prior to 3x-ui v.2.5.3, which stems from a failure to check the certificate option in the administration script x-ui, which could lead to the execution of arbitrary code...

x-ui Trust Management Issue Vulnerability

x-ui is a multi-protocol, multi-user xray panel from the individual developers at vaxilu. A security vulnerability exists in x-ui v1.8.3, which stems from a vulnerability that allows an attacker to obtain sensitive information via a default password...