CVE-2022-31161

Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for this issue.

• CWE-77
• CWE-94
• CWE-434

• http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html
• https://github.com/hap-wi/roxy-wi/releases/tag/v6.1.1.0Release Notes, Third Party Advisory
• https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-pg3w-8p63-x483Third Party Advisory
• http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html
• https://github.com/hap-wi/roxy-wi/releases/tag/v6.1.1.0Release Notes, Third Party Advisory
• https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-pg3w-8p63-x483Third Party Advisory

Published

Jul 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31156Gradle is a build tool. Dependency verification is a securit…4.4
• CVE-2022-31157LTI 1.3 Tool Library is a library used for building IMS-cert…7.5
• CVE-2022-31158LTI 1.3 Tool Library is a library used for building IMS-cert…7.5
• CVE-2022-31159The AWS SDK for Java enables Java developers to work with Am…6.5
• CVE-2022-3116The Heimdal Software Kerberos 5 implementation is vulnerable…7.5
• CVE-2022-31160jQuery UI is a curated set of user interface interactions, e…6.1
• CVE-2022-31162Slack Morphism is an async client library for Rust. Prior to…7.5
• CVE-2022-31163TZInfo is a Ruby library that provides access to time zone d…8.1
• CVE-2022-31164Tovy is a a staff management system for Roblox groups. A vul…7.5
• CVE-2022-31166XWiki Platform Old Core is a core package for XWiki Platform…8.8
• CVE-2022-31167XWiki Platform Security Parent POM contains the security API…6.5
• CVE-2022-31168Zulip is an open source team chat tool. Due to an incorrect …8.8