CVE-2026-90581

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90581", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-12T16:44:07.221Z", "datePublished": "2026-09-13T19:30:09.685Z", "dateUpdated": "2026-09-14T15:23:41.113Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-13T19:30:09.685Z"}, "title": "cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "cym1102", "product": "nginxWebUI", "versions": [{"version": "4.4.0", "status": "affected"}, {"version": "4.4.1", "status": "affected"}, {"version": "4.4.2", "status": "affected"}], "cpes": ["cpe:2.3:a:cym1102:nginxwebui:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-09-12T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-12T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-12T18:49:11.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "lem0n817 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/403166", "name": "VDB-403166 | cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/403166/cti", "name": "VDB-403166 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-90581", "name": "CVE-2026-90581 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/913328", "name": "Submit #913328 | cym1102 nginxWebUI 4.4.2 Code Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/cym1102/nginxWebUI/issues/213", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/cym1102/nginxWebUI/pull/215", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/cym1102/nginxWebUI/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-14T15:23:29.107628Z", "id": "CVE-2026-90581", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T15:23:41.113Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection", "credits": [{"lang": "en", "type": "reporter", "value": "lem0n817 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:cym1102:nginxwebui:*:*:*:*:*:*:*:*"], "vendor": "cym1102", "product": "nginxWebUI", "versions": [{"status": "affected", "version": "4.4.0"}, {"status": "affected", "version": "4.4.1"}, {"status": "affected", "version": "4.4.2"}]}], "timeline": [{"lang": "en", "time": "2026-09-12T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-12T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-12T18:49:11.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/403166", "name": "VDB-403166 | cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/403166/cti", "name": "VDB-403166 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-90581", "name": "CVE-2026-90581 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/913328", "name": "Submit #913328 | cym1102 nginxWebUI 4.4.2 Code Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/cym1102/nginxWebUI/issues/213", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/cym1102/nginxWebUI/pull/215", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/cym1102/nginxWebUI/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-13T19:30:09.685Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-90581", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-14T15:23:29.107628Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-09-14T15:23:35.948Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-90581", "state": "PUBLISHED", "dateUpdated": "2026-09-13T19:30:09.685Z", "dateReserved": "2026-09-12T16:44:07.221Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-13T19:30:09.685Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:cym1102:nginxwebui:*:*:*:*:*:*:*:*"], "product": "nginxWebUI", "vendor": "cym1102", "versions": [{"status": "affected", "version": "4.4.0"}, {"status": "affected", "version": "4.4.1"}, {"status": "affected", "version": "4.4.2"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance."}], "id": "CVE-2026-90581", "lastModified": "2026-09-14T20:56:48.220", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-90581", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-14T15:23:29.107628Z", "version": "2.0.3"}}]}, "published": "2026-09-13T20:16:51.487", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/cym1102/nginxWebUI/"}, {"source": "cna@vuldb.com", "url": "https://github.com/cym1102/nginxWebUI/issues/213"}, {"source": "cna@vuldb.com", "url": "https://github.com/cym1102/nginxWebUI/pull/215"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-90581"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/913328"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/403166"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/403166/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "nginxwebui", "vendor": "cym1102"}], "created": "2026-09-14T02:00:18.662967+00:00", "updated": "2026-09-15T17:15:14.213192+00:00", "vendors": ["cym1102", "cym1102$PRODUCT$nginxwebui"]}