CVE-2026-90581 in nginxWebUI

Prediction

by VulDB Data Team • 09/12/2026

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsible: VulDB
• Moderation: accepted
• Entry: VDB-403166
• CPE: ready
• CWE: CWE-94 (confirmed)
• Exploit: Download
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low
• Sector: Chemical, Finance, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-90581
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90581
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-90581/