roxy-wi

Records34All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical9CVSS 9.0–10.0

CVSS high18CVSS 7.0–8.9

Exploited now

roxy-wi records in CISA KEV

No roxy-wi vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Roxy-wi 20 records CRITICAL

Records

34 records

TI-2022-13181 CVE-2022-31137

Unauthenticated Remote Code Execution in Roxy-WI

CRITICAL 92

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.90577 Published 2022-07-08 Fixed in 6.1.1.0 CWE-78

TI-2022-13170 CVE-2022-31126

Unauthenticated Remote Code Execution in Roxy-wi

HIGH 81

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.52649 Published 2022-07-06 Fixed in 6.1.1.0 CWE-74

TI-2026-25520 CVE-2026-33078

Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter

HIGH 80

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00352 Published 2026-04-24 Fixed in 8.2.6.4 CWE-89

TI-2026-25518 CVE-2026-33076

Roxy-WI vulnerable to path traversal and arbitrary file writing

HIGH 80

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.0082 Published 2026-04-24 Fixed in 8.2.6.4 CWE-22

TI-2026-33307 CVE-2026-45558

Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save

HIGH 76

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00439 Published 2026-06-10 No fix listed CWE-20

TI-2026-33305 CVE-2026-45556

Improper input validation in roxy-wi

HIGH 76

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00372 Published 2026-06-10 No fix listed CWE-20

TI-2026-33301 CVE-2026-45552

Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server

HIGH 76

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00267 Published 2026-06-10 No fix listed CWE-639

TI-2026-33316 CVE-2026-45567

Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt

HIGH 75

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.00244 Published 2026-06-10 No fix listed CWE-287

TI-2026-33313 CVE-2026-45564

Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save)

HIGH 73

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00304 Published 2026-06-10 No fix listed CWE-78

TI-2026-25519 CVE-2026-33077

Roxy-WI has an arbitrary file read vulnerability

HIGH 73

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00428 Published 2026-04-24 Fixed in 8.2.6.4 CWE-22

TI-2026-22164 CVE-2026-27811

Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCE

HIGH 73

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02119 Published 2026-03-17 Fixed in 8.2.6.3 CWE-77

TI-2024-29398 CVE-2024-43804

OS Command Injection via Port Scan Functionality in Roxy-WI

HIGH 73

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02539 Published 2024-08-29 No fix listed CWE-78

TI-2026-33299 CVE-2026-45550

Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body

HIGH 72

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00196 Published 2026-06-10 No fix listed CWE-639

TI-2022-13204 CVE-2022-31161

Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload

HIGH 72

Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.28794 Published 2022-07-15 Fixed in 6.1.1.0 CWE-77

TI-2026-33318 CVE-2026-45569

Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)

HIGH 70

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00316 Published 2026-06-10 No fix listed CWE-22

TI-2026-33314 CVE-2026-45565

Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)

HIGH 70

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00304 Published 2026-06-10 No fix listed CWE-117

TI-2026-33298 CVE-2026-45549

Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host

HIGH 70

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00199 Published 2026-06-10 No fix listed CWE-862

TI-2026-25629 CVE-2026-33208

Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpoint

HIGH 68

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.0066 Published 2026-04-24 Fixed in 8.2.6.4 CWE-78

TI-2026-17875 CVE-2026-22265

Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE

HIGH 68

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.023 Published 2026-01-15 Fixed in 8.2.8.2 CWE-78

TI-2022-13169 CVE-2022-31125

Authentication Bypass in Roxy-wi

HIGH 68

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.20338 Published 2022-07-06 Fixed in 6.1.1.0 CWE-287

TI-2026-25828 CVE-2026-33431

Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer

HIGH 65

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00392 Published 2026-04-20 Fixed in 8.2.6.4 CWE-24

TI-2026-33310 CVE-2026-45561

Roxy-WI: SSRF in /smon/agent/<endpoint>/<server_ip> reachable to cloud metadata IPs

MEDIUM 62

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00218 Published 2026-06-10 No fix listed CWE-918

TI-2023-13465 CVE-2023-29004

Path Traversal Vulnerability in hap-wi/roxy-wi

MEDIUM 62

hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00902 Published 2023-04-17 No fix listed CWE-22

TI-2026-33315 CVE-2026-45566

Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass

MEDIUM 60

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00153 Published 2026-06-10 No fix listed CWE-601

TI-2026-33309 CVE-2026-45560

Roxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)

MEDIUM 60

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00149 Published 2026-06-10 No fix listed CWE-79

Open these records in search →

Critical	9
High	18
Medium	7
Low	0
No CVSS	0