CVE-2024-22196highCWE-89

CVE-2024-22196: falha de alta gravidade em 0xJacky nginx-ui

Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar nginx-ui+ Monitorar github.com/0xJacky/Nginx-UI

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7epss 0.6%
Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Produtos afetados
0xJacky · nginx-ui
CVEs relacionadas — 0xJacky nginx-ui

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33032CRITICALNginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx TakeoverEPSS 35.3%CVE-2024-49368HIGHUnchecked logrotate settings lead to arbitrary command executionEPSS 27.7%CVE-2026-27944CRITICALNginx UI: Unauthenticated Backup Download with Encryption Key DisclosureEPSS 22.8%CVE-2024-22198HIGHAuthenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)EPSS 4.1%CVE-2024-22197HIGHAuthenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)EPSS 1.5%CVE-2026-42221HIGHnginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin ClaimEPSS 1.3%