CVE-2024-46256

A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.08% chance of exploitation in the next 30 days, 87th percentile

Published

2024-09-27

Updated

2024-10-24

Proof-of-concept exploits (3)

• TranDongA3/Simulation_CVE-2024-46256
• kimtangker/CVE-2024-46256
• barttran2k/POC_CVE-2024-462566★ · 2024-09-19

References

• CVE Record
• NVD entry

Related

• CVE-2024-46257
• CVE-2025-1094
• CVE-2026-60137
• CVE-2026-63030
• CVE-2025-24893
• CVE-2024-46241