Skip to content
OpenAdvisories

Vendor

tobychui

4 known vulnerabilities.

Products

zoraxy 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.3
    CVE-2026-108899

    tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization

    A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. …

    tobychui zoraxy
  • High 7.4
    CVE-2026-100390

    Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6

    Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass au…

    tobychui zoraxy
  • High 8.6
    CVE-2024-52010 Public exploit

    Zoraxy has an authenticated command injection in the Web SSH feature

    Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows …

    tobychui zoraxy github.com/tobychui/zoraxy Go