Nginxui vulnerabilities
We track 5 vulnerabilities in Nginxui products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 21, 2024.
Latest Nginxui vulnerabilities
- 9.8 Critical severity
Nginx UI is a web user interface for the Nginx web server.
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes
- 7.5 High severity
nginx-ui: Missing Authorization
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. V
- 7.5 High severity
nginx-ui: Improper Limitation of a Pathname to a Restricted Directory
Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of `../../`. Arbitrary files can be written to the server, which
- 9.8 Critical severity
nginxWebUI: Improper Certificate Validation
A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveCmd. The manipulation of the argument nginxPath leads to improper certificate validation. It is possib
- 8.8 High severity
nginx-ui: Improper Neutralization of Special Elements used in a Command
Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` an