Roxy-wi vulnerabilities

Products

• Roxy-wi 35

Newest

• roxy-wi Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug) CVE-2026-45569 8.1 HighJune 10, 2026
• roxy-wi Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt CVE-2026-45567 8.3 HighJune 10, 2026
• roxy-wi Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass CVE-2026-45566 6.1 MediumJune 10, 2026
• roxy-wi Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors) CVE-2026-45565 8.1 HighJune 10, 2026
• roxy-wi Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save) CVE-2026-45564 8.8 HighJune 10, 2026
• roxy-wi Roxy-WI: IDOR — any authenticated user can read another user's full action history CVE-2026-45563 4.3 MediumJune 10, 2026
• roxy-wi Roxy-WI: SSRF in /smon/agent/<endpoint>/<server_ip> reachable to cloud metadata IPs CVE-2026-45561 6.5 MediumJune 10, 2026
• roxy-wi Roxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML) CVE-2026-45560 6.1 MediumJune 10, 2026
• roxy-wi Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only) CVE-2026-45559 4.9 MediumJune 10, 2026
• roxy-wi Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save CVE-2026-45558 9.9 CriticalJune 10, 2026
• roxy-wi Roxy-WI: Authenticated arbitrary file write on every managed load balancer (and downstream RCE) via WAF rule save `config_file_name` CVE-2026-45556 9.9 CriticalJune 10, 2026
• roxy-wi Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body CVE-2026-45550 9.1 CriticalJune 10, 2026
• roxy-wi Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host CVE-2026-45549 8.5 HighJune 10, 2026
• roxy-wi Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server CVE-2026-45552 9.9 CriticalJune 10, 2026
• roxy-wi Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpoint CVE-2026-33208 7.4 HighApril 24, 2026
• roxy-wi Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter CVE-2026-33078 8.9 HighApril 24, 2026
• roxy-wi Roxy-WI has an arbitrary file read vulnerability CVE-2026-33077 7.7 HighApril 24, 2026
• roxy-wi Roxy-WI vulnerable to path traversal and arbitrary file writing CVE-2026-33076 8.9 HighApril 24, 2026
• roxy-wi Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass CVE-2026-33432 7.7 HighApril 20, 2026
• roxy-wi Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer CVE-2026-33431 5.7 MediumApril 20, 2026
• roxy-wi Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCE CVE-2026-27811 8.8 HighMarch 17, 2026
• roxy-wi Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE CVE-2026-22265 7.5 HighJanuary 15, 2026
• roxy-wi Roxy-WI roxy.py action_service os command injection CVE-2024-13129 EPSS 17.7% 8.7 HighJanuary 3, 2025
• roxy-wi OS Command Injection via Port Scan Functionality in Roxy-WI CVE-2024-43804 8.8 HighAugust 29, 2024
• hap-wi roxy-wi Path Traversal Vulnerability in hap-wi/roxy-wi CVE-2023-29004 6.5 MediumApril 17, 2023
• hap-wi roxy-wi Roxy-WI vulnerable to Limited Path Traversal in name parameter CVE-2023-25804 7.5 HighMarch 15, 2023
• hap-wi roxy-wi Roxy-WI has Path Traversal vulnerability CVE-2023-25802 7.5 HighMarch 13, 2023
• hap-wi roxy-wi Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a directory traversal vulnerability that allows the inclusion of server-side file… CVE-2023-25803 7.5 HighMarch 13, 2023
• hap-wi roxy-wi Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload CVE-2022-31161 Public exploit EPSS 28.8% 10.0 CriticalJuly 15, 2022
• hap-wi roxy-wi Unauthenticated Remote Code Execution in Roxy-WI CVE-2022-31137 Public exploit EPSS 90.6% 10.0 CriticalJuly 8, 2022
• hap-wi roxy-wi Unauthenticated Remote Code Execution in Roxy-wi CVE-2022-31126 Public exploit EPSS 52.6% 10.0 CriticalJuly 6, 2022
• hap-wi roxy-wi Authentication Bypass in Roxy-wi CVE-2022-31125 Public exploit EPSS 20.3% 10.0 CriticalJuly 6, 2022
• roxy-wi Roxy-WI through 5.2.2.0 allows authenticated SQL injection via select_servers. CVE-2021-38168 8.8 HighAugust 7, 2021
• roxy-wi Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/api_funct.py. CVE-2021-38169 8.8 HighAugust 7, 2021
• roxy-wi Roxy-WI through 5.2.2.0 allows SQL Injection via check_login. An unauthenticated attacker can... CVE-2021-38167 9.8 CriticalAugust 7, 2021