github.com/0xJacky/Nginx-UI vulnerabilities (Go)
37 vulnerabilities.
-
github.com/0xJacky/Nginx-UIGo Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF) 7.1 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools 8.1 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) 8.8 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context 8.3 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) 8.8 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover 8.8 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable 5.4 Medium -
github.com/0xJacky/Nginx-UIGo Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint 8.7 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: Auto backup name allows path traversal outside validated storage path 6.3 Medium -
github.com/0xJacky/Nginx-UIGo Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE 8.8 High -
github.com/0xJacky/Nginx-UIGo Nginx UI OTP secure-session step-up is missing on sensitive mutation routes 8.3 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up 8.8 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM 7.5 High -
github.com/0xJacky/Nginx-UIGo 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser 8.8 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied 8.1 High -
github.com/0xJacky/Nginx-UIGo Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs 8.8 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) 8.1 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: Node Secret Credential Exposure via URL Query Parameter 8.8 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite 9.4 Critical -
github.com/0xJacky/Nginx-UIGo Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage 7.5 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout 5.3 Medium -
github.com/0xJacky/Nginx-UIGo nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim 8.1 High -
github.com/0xJacky/Nginx-UIGo nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback 6.5 Medium -
github.com/0xJacky/Nginx-UIGo Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services 8.5 High -
github.com/0xJacky/Nginx-UIGo Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints 5.5 Medium -
github.com/0xJacky/Nginx-UIGo Nginx-UI: Disabled users retain full API access through previously issued bearer tokens 8.6 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover 9.8 Critical -
github.com/0xJacky/Nginx-UIGo Nginx UI: DoS via Negative Integer Input in Logrotate Interval 6.9 Medium -
github.com/0xJacky/Nginx-UIGo Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse 7.1 High -
github.com/0xJacky/Nginx-UIGo Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory 6.9 Medium -
github.com/0xJacky/Nginx-UIGo nginx-ui Backup Restore Allows Tampering with Encrypted Backups 9.4 Critical -
github.com/0xJacky/Nginx-UIGo Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure 9.8 Critical -
github.com/0xJacky/Nginx-UIGo Nginx-UI authenticated RCE through injecting into the application config via CRLF 8.8 High -
github.com/0xJacky/Nginx-UIGo Nginx-UI arbitrary file write through the Import Certificate feature 9.8 Critical -
github.com/0xJacky/Nginx-UIGo Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268) 7.1 High -
github.com/0xJacky/Nginx-UIGo Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269) 7.7 High -
github.com/0xJacky/Nginx-UIGo Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270) 7.0 High