VendorsNginx UInginx_uiany version

Vulnerabilities

Nginx UI Nginx Ui any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

21CVEs

Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

Published 2026-05-12 · Modified

9.9EPSS 0.004

Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys

Published 2026-03-30 · Analyzed

9.9EPSS 0.004

Unchecked logrotate settings lead to arbitrary command execution

Published 2024-10-21 · Analyzed

9.8EPSS 0.277

Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

Published 2026-03-30 · Modified

9.8EPSS 0.025

nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

Published 2026-05-04 · Analyzed

9.8EPSS 0.016

Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

Published 2026-03-05 · Analyzed

9.8EPSS 0.010

Unauthenticated Remote Code Execution via Backup Restore in nginx-ui

Published 2026-05-04 · Analyzed

9.8EPSS 0.008

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

Published 2026-03-30 · Analyzed

9.4EPSS 0.002

Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

Published 2024-01-11 · Modified

8.8EPSS 0.041

Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

Published 2024-01-11 · Modified

8.8EPSS 0.015

Nginx-UI authenticated RCE through injecting into the application config via CRLF

Published 2024-01-29 · Modified

8.8EPSS 0.011

Nginx-UI: Disabled users retain full API access through previously issued bearer tokens

Published 2026-04-20 · Analyzed

8.6EPSS 0.004

Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints

Published 2026-04-20 · Analyzed

8.1EPSS 0.002

Nginx UI's json field can construct a directory traversal payload, causing arbitrary files to be written

Published 2024-10-21 · Analyzed

7.7EPSS 0.006

Nginx UI's log path can be controlled

Published 2024-10-21 · Analyzed

7.5EPSS 0.006

Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse

Published 2026-03-30 · Analyzed

7.5EPSS 0.006

Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

Published 2024-01-11 · Modified

7.0EPSS 0.006

Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory

Published 2026-03-30 · Analyzed

6.9EPSS 0.005

Nginx UI: DoS via Negative Integer Input in Logrotate Interval

Published 2026-03-30 · Analyzed

6.9EPSS 0.005

nginx-ui: Settings API Exposes Protected Secrets

Published 2026-05-04 · Analyzed

6.5EPSS 0.004

nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback

Published 2026-05-04 · Analyzed

6.5EPSS 0.004