CVE-2024-3738

A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveCmd. The manipulation of the argument nginxPath leads to improper certificate validation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260577 was assigned to this vulnerability.

• CWE-295

• https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdfExploit
• https://github.com/cym1102/nginxWebUI/issues/138Issue Tracking
• https://vuldb.com/?ctiid.260577Permissions Required, VDB Entry
• https://vuldb.com/?id.260577Third Party Advisory, VDB Entry
• https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdfExploit
• https://github.com/cym1102/nginxWebUI/issues/138Issue Tracking
• https://vuldb.com/?ctiid.260577Permissions Required, VDB Entry
• https://vuldb.com/?id.260577Third Party Advisory, VDB Entry

Published

Apr 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37372The Permission Model assumes that any path starting with two…3.6
• CVE-2024-37373Improper input validation in the Central Filestore in Ivanti…7.2
• CVE-2024-37374Rejected reason: This CVE record has been withdrawn due to a…
• CVE-2024-37375Rejected reason: This CVE record has been withdrawn due to a…
• CVE-2024-37376SQL injection in Ivanti Endpoint Manager before 2024 Novembe…7.2
• CVE-2024-37377A heap-based buffer overflow in IPsec of Ivanti Connect Secu…7.5
• CVE-2024-37380A misconfiguration on UniFi U6+ Access Point could cause an …5.3
• CVE-2024-37381An unspecified SQL Injection vulnerability in Core server of…8
• CVE-2024-37382An issue discovered in import host feature in Ab Initio Meta…7.2
• CVE-2024-37383Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows…6.1
• CVE-2024-37384Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows…6.1
• CVE-2024-37385Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Win…9.8