Betroffene Versionslinien
Bekannte Schwachstellen
| CVE | Titel | Betroffene Versionen | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|---|
| CVE-2026-102335 | Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config | ≤ 2.16.0 | 7.1 | — | 2026-09-29 | |
| CVE-2026-102334 | Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection | ≤ 2.16.0 | 9.1 | — | 2026-09-29 | |
| CVE-2026-93964 | NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authe... | = 2.0 = 2.1 = 2.1.0 | 6.9 | — | 2026-09-20 | |
| CVE-2026-40519 | Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins() | ≥ 2.9.14 ≤ 2.15.1 | 7.7 | — | 2026-06-09 | |
| CVE-2025-50579 | A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, p... | * | 5.3 | — | 2025-08-19 | |
| CVE-2024-46257 | A Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2.11.3 allows... | * | 6.3 | — | 2024-09-27 | |
| CVE-2024-46256 | A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to R... | * | 9.8 | — | 2024-09-27 | |
| CVE-2024-39935 | jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authe... | * | 8.8 | — | 2024-07-04 | |
| CVE-2023-27224 | An issue found in NginxProxyManager v.2.9.19 allows an attacker to execute arbitrary code via a lua script to... | * | 9.8 | — | 2023-03-22 | |
| CVE-2023-23596 | jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend... | * | 8.8 | — | 2023-01-20 | |
| CVE-2022-28379 | jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion. | * < 2.9.17 | 4.8 | — | 2022-04-03 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).