CVE-2026-90581

MEDIUM 6.3

cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

CWE	CWE-94 CWE-74
Vendor	cym1102
Product	nginxwebui
Published	Sep 13, 2026
Last Updated	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for cym1102 nginxwebui

Be the first to know when new medium vulnerabilities affecting cym1102 nginxwebui are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

cym1102 / nginxWebUI

4.4.0 4.4.1 4.4.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/403166 vuldb.com: https://vuldb.com/vuln/403166/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90581 vuldb.com: https://vuldb.com/submit/913328 github.com: https://github.com/cym1102/nginxWebUI/issues/213 github.com: https://github.com/cym1102/nginxWebUI/pull/215 github.com: https://github.com/cym1102/nginxWebUI/

Credits

🔍 lem0n817 (VulDB User) VulDB CNA Team