Vulnerabilidades en 0xJacky
44 resultadosCVE-2026-33032CRITICALNginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx TakeoverEPSS 35.3%CVE-2024-49368HIGHUnchecked logrotate settings lead to arbitrary command executionEPSS 27.7%CVE-2026-27944CRITICALNginx UI: Unauthenticated Backup Download with Encryption Key DisclosureEPSS 22.8%CVE-2024-22198HIGHAuthenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)EPSS 4.1%CVE-2024-22197HIGHAuthenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)EPSS 1.5%CVE-2026-42221HIGHnginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin ClaimEPSS 1.3%CVE-2024-23828HIGHNginx-UI authenticated RCE through injecting into the application config via CRLFEPSS 1.1%CVE-2026-33029MEDIUMNginx UI: DoS via Negative Integer Input in Logrotate IntervalEPSS 1.0%CVE-2026-42238CRITICALUnauthenticated Remote Code Execution via Backup Restore in nginx-uiEPSS 1.0%CVE-2026-84318HIGHNginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCEEPSS 0.8%CVE-2024-23827CRITICALNginx-UI arbitrary file write through the Import Certificate featureEPSS 0.7%CVE-2024-49367MEDIUMNginx UI's log path can be controlledEPSS 0.6%CVE-2024-49366HIGHNginx UI's json field can construct a directory traversal payload, causing arbitrary files to be writtenEPSS 0.6%CVE-2024-22196HIGHAuthenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)EPSS 0.6%CVE-2026-107806CRITICALNginx UI: Authenticated Remote Code Execution via Backup Restore App Config OverwriteEPSS 0.6%CVE-2026-33028HIGHNginx UI: Race Condition Leads to Persistent Data Corruption and Service CollapseEPSS 0.6%CVE-2026-84313HIGHNginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeoverEPSS 0.5%CVE-2026-84316HIGHNginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)EPSS 0.5%CVE-2026-84317HIGHNginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)EPSS 0.5%CVE-2026-107805HIGHNginx UI: Unauthenticated signed-request body staging can exhaust temporary storageEPSS 0.5%