CVE-2026-90581 — cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection
A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipula…
Published: 2026-09-13 · CVSS: 5.3 · CVSS 4.0
A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7