CVE-2022-28379: Nginx Proxy Manager stored XSS during item deletion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityCVSS rates it medium (4.8) and exploitation needs high privileges plus user interaction, but public exploit detail and a very high EPSS score raise the practical risk.

What it is

Nginx Proxy Manager before 2.9.17 is vulnerable to cross-site scripting that triggers during item deletion. The flaw is a CWE-79 issue in the admin interface, and the record does not describe the exact parameter or field involved. It matters because the affected component is the management UI for a reverse proxy, so script execution there can reach an operator with broad control over proxied traffic.

Impact

An attacker can execute script in the context of an authenticated Nginx Proxy Manager user, potentially stealing session data or performing actions as that user. The CVSS scope change (S:C) indicates the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through the web management interface, per the CVSS vector AV:N. Exploitation requires high privileges (PR:H) and user interaction (UI:R), meaning an authenticated admin-level user must trigger the deletion action.

Exploitation

No CISA KEV listing and no ransomware association are recorded. EPSS is high (0.71209, 99.378th percentile), and the references include an issue tagged Exploit, indicating public proof-of-concept detail exists.

What to do

• Upgrade Nginx Proxy Manager to 2.9.17 or later, which the release notes identify as the fixed version.
• Restrict access to the Nginx Proxy Manager admin interface to trusted networks or a management VPN.
• Enforce least privilege so only necessary accounts hold admin-level rights, since exploitation requires high privileges.
• Sanitize or encode user-supplied values rendered in the deletion flow if you cannot patch immediately.

Detection

• Review Nginx Proxy Manager access and application logs for deletion requests containing script tags or unusual encoded payloads.
• Monitor for anomalous admin sessions, including unexpected session token use or configuration changes after deletion actions.
• Inspect proxy host and related records for stored script content that would render in the admin UI.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.