Vulnerabilities

TI-2026-33318 CVE-2026-45569

Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)

HIGH 70

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00316 Published 2026-06-10 No fix listed CWE-22

TI-2026-33316 CVE-2026-45567

Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt

HIGH 75

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.00244 Published 2026-06-10 No fix listed CWE-287

TI-2026-33315 CVE-2026-45566

Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass

MEDIUM 60

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00153 Published 2026-06-10 No fix listed CWE-601

TI-2026-33314 CVE-2026-45565

Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)

HIGH 70

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00304 Published 2026-06-10 No fix listed CWE-117

TI-2026-33313 CVE-2026-45564

Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save)

HIGH 73

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00304 Published 2026-06-10 No fix listed CWE-78

TI-2026-33312 CVE-2026-45563

Roxy-WI: IDOR — any authenticated user can read another user's full action history

MEDIUM 53

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00176 Published 2026-06-10 No fix listed CWE-639

TI-2026-33310 CVE-2026-45561

Roxy-WI: SSRF in /smon/agent/<endpoint>/<server_ip> reachable to cloud metadata IPs

MEDIUM 62

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00218 Published 2026-06-10 No fix listed CWE-918

TI-2026-33309 CVE-2026-45560

Roxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)

MEDIUM 60

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00149 Published 2026-06-10 No fix listed CWE-79

TI-2026-33308 CVE-2026-45559

Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only)

MEDIUM 56

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00234 Published 2026-06-10 No fix listed CWE-90

TI-2026-33307 CVE-2026-45558

Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save

HIGH 76

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00439 Published 2026-06-10 No fix listed CWE-20

TI-2026-33305 CVE-2026-45556

Improper input validation in roxy-wi

HIGH 76

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00372 Published 2026-06-10 No fix listed CWE-20

TI-2026-33299 CVE-2026-45550

Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body

HIGH 72

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00196 Published 2026-06-10 No fix listed CWE-639

TI-2026-33298 CVE-2026-45549

Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host

HIGH 70

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00199 Published 2026-06-10 No fix listed CWE-862

TI-2026-33301 CVE-2026-45552

Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server

HIGH 76

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00267 Published 2026-06-10 No fix listed CWE-639

TI-2026-25629 CVE-2026-33208

Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpoint

HIGH 68

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.0066 Published 2026-04-24 Fixed in 8.2.6.4 CWE-78

TI-2026-25520 CVE-2026-33078

Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter

HIGH 80

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00352 Published 2026-04-24 Fixed in 8.2.6.4 CWE-89

TI-2026-25519 CVE-2026-33077

Roxy-WI has an arbitrary file read vulnerability

HIGH 73

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00428 Published 2026-04-24 Fixed in 8.2.6.4 CWE-22

TI-2026-25518 CVE-2026-33076

Roxy-WI vulnerable to path traversal and arbitrary file writing

HIGH 80

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.0082 Published 2026-04-24 Fixed in 8.2.6.4 CWE-22

TI-2026-25829 CVE-2026-33432

Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass

MEDIUM 40

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00423 Published 2026-04-20 No fix listed CWE-287

TI-2026-25828 CVE-2026-33431

Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer

HIGH 65

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00392 Published 2026-04-20 Fixed in 8.2.6.4 CWE-24

TI-2026-22164 CVE-2026-27811

Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCE

HIGH 73

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02119 Published 2026-03-17 Fixed in 8.2.6.3 CWE-77

TI-2026-17875 CVE-2026-22265

Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE

HIGH 68

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.023 Published 2026-01-15 Fixed in 8.2.8.2 CWE-78

TI-2024-29398 CVE-2024-43804

OS Command Injection via Port Scan Functionality in Roxy-WI

HIGH 73

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02539 Published 2024-08-29 No fix listed CWE-78

TI-2023-13465 CVE-2023-29004

Path Traversal Vulnerability in hap-wi/roxy-wi

MEDIUM 62

hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00902 Published 2023-04-17 No fix listed CWE-22

TI-2023-11075 CVE-2023-25804

Roxy-WI vulnerable to Limited Path Traversal in name parameter

MEDIUM 40

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00761 Published 2023-03-15 Fixed in 6.3.5.0 CWE-22

Vulnerabilities

Filters