Vulnerabilities

TI-2026-25629 CVE-2026-33208

Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpoint

HIGH 68

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.0066 Published 2026-04-24 Fixed in 8.2.6.4 CWE-78

TI-2026-25520 CVE-2026-33078

Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter

HIGH 80

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00352 Published 2026-04-24 Fixed in 8.2.6.4 CWE-89

TI-2026-25519 CVE-2026-33077

Roxy-WI has an arbitrary file read vulnerability

HIGH 73

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00428 Published 2026-04-24 Fixed in 8.2.6.4 CWE-22

TI-2026-25518 CVE-2026-33076

Roxy-WI vulnerable to path traversal and arbitrary file writing

HIGH 80

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.0082 Published 2026-04-24 Fixed in 8.2.6.4 CWE-22

TI-2026-25829 CVE-2026-33432

Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass

MEDIUM 40

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00423 Published 2026-04-20 No fix listed CWE-287

TI-2026-25828 CVE-2026-33431

Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer

HIGH 65

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00392 Published 2026-04-20 Fixed in 8.2.6.4 CWE-24

TI-2026-22164 CVE-2026-27811

Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCE

HIGH 73

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02119 Published 2026-03-17 Fixed in 8.2.6.3 CWE-77

TI-2026-17875 CVE-2026-22265

Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE

HIGH 68

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.023 Published 2026-01-15 Fixed in 8.2.8.2 CWE-78

TI-2024-29398 CVE-2024-43804

OS Command Injection via Port Scan Functionality in Roxy-WI

HIGH 73

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02539 Published 2024-08-29 No fix listed CWE-78

TI-2023-13465 CVE-2023-29004

Path Traversal Vulnerability in hap-wi/roxy-wi

MEDIUM 62

hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00902 Published 2023-04-17 No fix listed CWE-22

TI-2023-11075 CVE-2023-25804

Roxy-WI vulnerable to Limited Path Traversal in name parameter

MEDIUM 40

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00761 Published 2023-03-15 Fixed in 6.3.5.0 CWE-22

TI-2023-11073 CVE-2023-25802

Roxy-WI has Path Traversal vulnerability

MEDIUM 41

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01012 Published 2023-03-13 Fixed in 6.3.6.0 CWE-22

TI-2023-11074 CVE-2023-25803

Path traversal in roxy-wi

MEDIUM 41

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01206 Published 2023-03-13 Fixed in 6.3.5.0 CWE-22

TI-2022-13204 CVE-2022-31161

Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload

HIGH 72

Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.28794 Published 2022-07-15 Fixed in 6.1.1.0 CWE-77

TI-2022-13181 CVE-2022-31137

Unauthenticated Remote Code Execution in Roxy-WI

CRITICAL 92

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.90577 Published 2022-07-08 Fixed in 6.1.1.0 CWE-78

TI-2022-13170 CVE-2022-31126

Unauthenticated Remote Code Execution in Roxy-wi

HIGH 81

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.52649 Published 2022-07-06 Fixed in 6.1.1.0 CWE-74

TI-2022-13169 CVE-2022-31125

Authentication Bypass in Roxy-wi

HIGH 68

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.20338 Published 2022-07-06 Fixed in 6.1.1.0 CWE-287

TI-2021-15847 CVE-2021-38168 · GHSA-3x62-5wxc-9c6p

Roxy-WI through 5.2.2.0 allows authenticated SQL injection via select_servers.

MEDIUM 40

Roxy-WI through 5.2.2.0 allows authenticated SQL injection via select_servers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00939 Published 2021-08-07 No fix listed CWE-89

TI-2021-15848 CVE-2021-38169 · GHSA-9vf8-53q8-5wwr

Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/api_funct.py.

MEDIUM 41

Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/api_funct.py.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01528 Published 2021-08-07 No fix listed CWE-77

TI-2021-15846 CVE-2021-38167 · GHSA-mg3v-vrx5-2853

Roxy-WI through 5.2.2.0 allows SQL Injection via check_login.

MEDIUM 45

Roxy-WI through 5.2.2.0 allows SQL Injection via check_login.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01286 Published 2021-08-07 No fix listed CWE-89

Vulnerabilities

Filters