Skip to content
OpenAdvisories

Vendor

0xJacky

44 known vulnerabilities.

Products

nginx-ui 44
All Critical High Medium Low Exploited only Public exploit

44 results · Feed

  • Critical 9.8
    CVE-2024-23827

    Nginx-UI arbitrary file write through the Import Certificate feature

    Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the sys…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 7.1
    CVE-2024-22198 Public exploit

    Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

    Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` a…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 7.0
    CVE-2024-22196

    Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

    Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default val…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • High 7.7
    CVE-2024-22197

    Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

    Nginx-ui is online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home > Preference` page exposes a small list of nginx settings such as `Nginx Access Log Path` and `Nginx Error Log Path`. H…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go