CVE-2026-2145 - Vulnerability Details

- cym1102 nginxWebUI Web Management check cross site scripting

Description

A vulnerability was identified in cym1102 nginxWebUI up to 4.3.7. The impacted element is an unknown function of the file /adminPage/conf/check of the component Web Management Interface. Such manipulation of the argument nginxDir leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Published: 2026-02-08

Score: 5.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A reflected cross‑site scripting vulnerability exists in the web management interface of cym1102 nginxWebUI in an unknown function of /adminPage/conf/check. Manipulating the nginxDir argument allows an attacker to inject arbitrary JavaScript into pages presented to a user.

Affected Systems

The flaw affects all installations of cym1102 nginxWebUI up to and including version 4.3.7, specifically the /adminPage/conf/check endpoint. No other products or newer versions are known to be vulnerable.

Risk and Exploitability

The CVSS base score of 5.1 indicates moderate severity, while an EPSS score of less than 1 % indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to the web application and the ability to supply requests to the nginxDir parameter; an attacker can trigger the payload remotely without additional authentication. The flaw enables arbitrary JavaScript execution within the context of the user viewing the page.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

cym1102

nginxWebUI

affected

Version	Status	Constraints
`4.3.0`	affected	—
`4.3.1`	affected	—
`4.3.2`	affected	—
`4.3.3`	affected	—
`4.3.4`	affected	—
`4.3.5`	affected	—
`4.3.6`	affected	—
`4.3.7`	affected	—

Configuration 1 [-]

cpe:2.3:a:cym1102:nginxwebui:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Confidence	Versions
Cym1102	Nginxwebui	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a version of cym1102 nginxWebUI newer than 4.3.7 or apply any vendor‑supplied patch for the XSS issue.
Implement proper input validation and output encoding for the nginxDir parameter to neutralize user‑supplied data before rendering.
Configure a Web Application Firewall or equivalent rule set to detect and block common XSS payloads and monitor traffic to /adminPage/conf/check for suspicious activity.

Generated by OpenCVE AI on April 18, 2026 at 13:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00018.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/cym1102/nginxWebUI/
https://github.com/cym1102/nginxWebUI/issues/203
https://github.com/cym1102/nginxWebUI/issues/203#issue-3860109934
https://vuldb.com/?ctiid.344847
https://vuldb.com/?id.344847
https://vuldb.com/?submit.747404

History

Thu, 05 Mar 2026 21:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:cym1102:nginxwebui::::::::

Tue, 10 Feb 2026 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 09 Feb 2026 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cym1102 Cym1102 nginxwebui
Vendors & Products		Cym1102 Cym1102 nginxwebui

Sun, 08 Feb 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was identified in cym1102 nginxWebUI up to 4.3.7. The impacted element is an unknown function of the file /adminPage/conf/check of the component Web Management Interface. Such manipulation of the argument nginxDir leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Title		cym1102 nginxWebUI Web Management check cross site scripting
Weaknesses		CWE-79 CWE-94
References		https://github.com/cym1102/nginxWebUI/ https://github.com/cym1102/nginxWebUI/issues/203 https://github.com/cym1102/nginxWebUI/issues/203#issue-3860109934 https://vuldb.com/?ctiid.344847 https://vuldb.com/?id.344847 https://vuldb.com/?submit.747404
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Cym1102 Nginxwebui

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-02-08T09:02:07.687Z

Updated: 2026-02-23T09:40:15.515Z

Reserved: 2026-02-07T07:47:28.175Z

Link: CVE-2026-2145

Vulnrichment

Updated: 2026-02-10T21:18:53.426Z

NVD

Status : Analyzed

Published: 2026-02-08T09:15:52.943

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-2145

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-18T13:30:45Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object