Nginx Proxy Manager vulnerabilities
3 known vulnerabilities in Nginx Proxy Manager from NginxProxyManager. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
nginx-proxy-manager: Incorrect Authorization
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives
- 7.4 High severity
nginx-proxy-manager: Improper Restriction of Excessive Authentication Attempts
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently gue
- 7.5 High severity
nginx-proxy-manager: Improper Neutralization of Special Elements used in an OS Command
Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function in backend/setup.js, allowing attackers with certificates:m