CVE-2024-3739

A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload. The manipulation of the argument file leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260578 is the identifier assigned to this vulnerability.

• CWE-78

• https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdfExploit
• https://github.com/cym1102/nginxWebUI/issues/138Issue Tracking
• https://vuldb.com/?ctiid.260578Permissions Required, VDB Entry
• https://vuldb.com/?id.260578Third Party Advisory, VDB Entry
• https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdfExploit
• https://github.com/cym1102/nginxWebUI/issues/138Issue Tracking
• https://vuldb.com/?ctiid.260578Permissions Required, VDB Entry
• https://vuldb.com/?id.260578Third Party Advisory, VDB Entry

Published

Apr 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37384Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows…6.1
• CVE-2024-37385Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Win…9.8
• CVE-2024-37386An issue was discovered in Stormshield Network Security (SNS…4.2
• CVE-2024-37387Use of potentially dangerous function issue exists in Ricoh …4
• CVE-2024-37388An XML External Entity (XXE) vulnerability in the ebookmeta.…9.1
• CVE-2024-37389Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0…5.4
• CVE-2024-37391ProtonVPN before 3.2.10 on Windows mishandles the drive inst…7.8
• CVE-2024-37392A stored Cross-Site Scripting (XSS) vulnerability has been i…6.1
• CVE-2024-37393Multiple LDAP injections vulnerabilities exist in SecurEnvoy…7.5
• CVE-2024-37394A stored cross-site scripting (XSS) vulnerability in the Pro…5.4
• CVE-2024-37395A stored cross-site scripting (XSS) vulnerability in the Pub…5.4
• CVE-2024-37396A stored cross-site scripting (XSS) vulnerability in the Cal…5.4