September 20, 2026

CVE Watchtower

← Back to CVE List

CVE-2026-90581NVD

Description

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Severity Level
MEDIUM (6.3)
Published Date
13/09/2026
Last Modified
14/09/2026
Exploitation Status
????
EPSS Score
0.24% (percentile 15.7%)

CVSS Base Metrics

CVSS v3 (3.1)
MEDIUM 6.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS v4 (4.0)
MEDIUM 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Weaknesses (CWE)

CWE-94 - Code InjectionCWE-74 - Injection

Affected & Patched Versions

ProductAffected VersionsPatched Version
cym1102 nginxWebUI4.4.0, 4.4.1, 4.4.2N/A
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.
📧Email Delivery — Threat intel straight to your inbox.
♾️Unlimited Vendors — Track your entire stack.
🚨All New CVEs — Be the first to know.
⚙️Custom EPSS — Filter noise, focus on risk.
💬Webhooks — Slack & Teams integration.
🚫Ad-Free — Uninterrupted experience.

References