0xjacky
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 11 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from October 9, 2026 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
Monitor 0xjacky in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.