Nginx Proxy Manager vulnerabilities

2 known vulnerabilities in Nginx Proxy Manager from Jc21. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  nginx_proxy_manager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-39935Jul 4, 2024Jc21

  jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificate management privileges) via untrusted input to the DNS provider configuration. NOTE: this is not part of any NGINX soft

• 8.8 High severity

  Nginx Proxy Manager: Improper Neutralization of Special Elements used in an OS Command

  CVE-2023-23596Jan 20, 2023Jc21EPSS 15.6%

  jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec c