CVE-2024-46256

NginxProxyManager version 2.11.3 is vulnerable to a Command injection vulnerability in the requestLetsEncryptSsl function. The root cause is a lack of sufficient data sanitization at the control level when handling certificate requests. A malicious actor can exploit this by adding a specially cra...

CVE-2024-39935

jc21 NGINX Proxy Manager versions prior to 2.11.3 are vulnerable to an OS command injection vulnerability in the backend/internal/certificate.js component. The issue arises because the application fails to neutralize special elements in the OS commands when processing untrusted input from the DNS...

CVE-2024-46257

A Command injection vulnerability exists in the requestLetsEncryptSslWithDnsChallenge function of NginxProxyManager 2.11.3 . The root cause is a lack of data cleansing measures at the management level, which allows an authenticated attacker to execute arbitrary commands. This can lead to Remote C...

CVE-2023-27224

CVE-2023-27224 affects NginxProxyManager v2.9.19. A vulnerability allows remote attackers to execute arbitrary code by injecting a Lua script into the configuration file, due to insufficient input/data sanitization at the management level. This is described across multiple sources, and the impact...

CVE-2019-15517

jc21 Nginx Proxy Manager

CVE-2023-23596

CVE-2023-23596 affects jc21 NGINX Proxy Manager up to version 2.9.19. The issue arises when creating an access list: the backend builds an htpasswd file using crafted username/password inputs that are concatenated without validation and directly passed to an exec command, enabling potential OS co...

CVE-2025-50579

A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, specifically JWT tokens , due to improper validation of the Origin header . Attackers can leverage a simple browser script to intercept and exfiltrate these tokens to a remote server, pote...