Skip to content
OpenAdvisories

Vendor

tobychui

4 known vulnerabilities.

tobychui at a glance

Last 12 months
3
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202610
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202610
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

zoraxy 4
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.3
    CVE-2026-108899

    tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization

    A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. …

    tobychui zoraxy
  • High 7.4
    CVE-2026-100390

    Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6

    Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass au…

    tobychui zoraxy
  • Low 3.3
    CVE-2026-33529

    Zoraxy: Authenticated Path Traversal in Config Import leads to RCE

    Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, …

    tobychui zoraxy github.com/tobychui/zoraxy Go
  • High 8.6
    CVE-2024-52010 Public exploit

    Zoraxy has an authenticated command injection in the Web SSH feature

    Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows …

    tobychui zoraxy github.com/tobychui/zoraxy Go