GCVE - cpe:2.3:a:cym1102:nginxwebui:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cym1102:nginxwebui:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Cym1102 (`8122e882-7f6a-5ec1-81a2-5493b92dd028`)
Product	Nginxwebui (`6338299d-c202-5bbf-82f7-5ca985025a21`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:gitee/cym1102/nginxwebui`	purl2cpe	2026-06-01 10:15:56.054660
`pkg:github/cym1102/nginxwebui`	purl2cpe	2026-06-01 10:15:56.054662

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-90581`	vulnerable	2026-09-16 04:33:05.499988	cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection MEDIUM (6.3) A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance. Published: 2026-09-13T19:30:09.685Z Updated: 2026-09-14T15:23:41.113Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/403166 https://vuldb.com/vuln/403166/cti https://vuldb.com/cve/CVE-2026-90581 https://vuldb.com/submit/913328 https://github.com/cym1102/nginxWebUI/issues/213	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2145`	vulnerable	2026-06-08 07:55:16.610744	cym1102 nginxWebUI Web Management check cross site scripting LOW (3.5) A vulnerability was identified in cym1102 nginxWebUI up to 4.3.7. The impacted element is an unknown function of the file /adminPage/conf/check of the component Web Management Interface. Such manipulation of the argument nginxDir leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet. Published: 2026-02-08T09:02:07.687Z Updated: 2026-02-23T09:40:15.515Z Open on db.gcve.eu Reference links https://vuldb.com/?id.344847 https://vuldb.com/?ctiid.344847 https://vuldb.com/?submit.747404 https://github.com/cym1102/nginxWebUI/issues/203 https://github.com/cym1102/nginxWebUI/issues/203#issue-3860109934	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3740`	vulnerable	2026-06-08 06:43:51.344971	cym1102 nginxWebUI reload exec deserialization MEDIUM (6.3) A vulnerability, which was classified as critical, has been found in cym1102 nginxWebUI up to 3.9.9. This issue affects the function exec of the file /adminPage/conf/reload. The manipulation of the argument nginxExe leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260579. Published: 2024-04-13T20:31:05.513Z Updated: 2024-08-12T13:11:49.334Z Open on db.gcve.eu Reference links https://vuldb.com/?id.260579 https://vuldb.com/?ctiid.260579 https://vuldb.com/?submit.311216 https://github.com/cym1102/nginxWebUI/issues/138 https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3739`	vulnerable	2026-06-08 06:43:51.344471	cym1102 nginxWebUI upload os command injection MEDIUM (6.3) A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload. The manipulation of the argument file leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260578 is the identifier assigned to this vulnerability. Published: 2024-04-13T18:31:05.295Z Updated: 2024-08-01T20:20:01.086Z Open on db.gcve.eu Reference links https://vuldb.com/?id.260578 https://vuldb.com/?ctiid.260578 https://github.com/cym1102/nginxWebUI/issues/138 https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3738`	vulnerable	2026-06-08 06:43:51.343848	cym1102 nginxWebUI saveCmd handlePath certificate validation HIGH (7.3) A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveCmd. The manipulation of the argument nginxPath leads to improper certificate validation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260577 was assigned to this vulnerability. Published: 2024-04-13T17:31:04.866Z Updated: 2024-09-03T17:59:26.886Z Open on db.gcve.eu Reference links https://vuldb.com/?id.260577 https://vuldb.com/?ctiid.260577 https://github.com/cym1102/nginxWebUI/issues/138 https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3737`	vulnerable	2026-06-08 06:43:51.341389	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3736`	vulnerable	2026-06-08 06:43:51.340881	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Nginxwebui

Notes

PURL mappings

Vulnerability references

Contribute