CVE-2026-33078
Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the URL path, is passed unsanitized through multiple function calls and ultimately interpolated into a SQL query string using Python string formatting, allowing attackers to execute arbitrary SQL commands. Version 8.2.6.4 fixes the issue.
| CWE | CWE-89 |
| Vendor | roxy-wi |
| Product | roxy-wi |
| Published | Apr 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for roxy-wi roxy-wi
Be the first to know when new unknown vulnerabilities affecting roxy-wi roxy-wi are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
roxy-wi / roxy-wi
< 8.2.6.4