CVE-2025-12666: Improper Neutralization of Input During Web Page Generation

The Google Drive upload and download link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter of the 'atachfilegoogle' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-9965

The CVE-2025-9965 entry concerns Novakon P series devices (P – V2001.A.C518o2) with an improper authentication vulnerability that allows unauthenticated attackers to upload and download arbitrary applications to/from the device. The root cause is improper authentication on P series control interf...

CVE-2025-9965: Improper Authentication

Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to the device.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 commit d0f97fd9...

CVE-2024-11667: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50W series firmware versions V5.10 through V5.38, and USG20W-VPN series firmware versions V5.10 through...

CVE-2023-1109: Improper Limitation of a Pathname to a Restricted Directory

In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the...

Webmin <= 1.994 Multiple Vulnerabilities

Webmin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webmin:webmin"; ifdescription...

CVE-2021-32159

A Cross-site request forgery CSRF vulnerability exists in Webmin 1.973 via the Upload and Download feature...

CVE-2021-32158

A Cross-Site Scripting XSS vulnerability exists in Webmin 1.973 via the Upload and Download feature...

Cross site scripting

A Cross-Site Scripting XSS vulnerability exists in Webmin 1.973 via the Upload and Download feature...

CVE-2021-32158

A Cross-Site Scripting XSS vulnerability exists in Webmin 1.973 via the Upload and Download feature...

CVE-2021-32158

CVE-2021-32158 is an XSS vulnerability in Webmin 1.973 exploited via the Upload and Download feature. The issue stems from insufficient input filtering/escaping of user-supplied parameters in that function, enabling script execution in the client context. The CVE is corroborated by multiple sourc...

PT-2022-10067

Name of the Vulnerable Software and Affected Versions Webmin version 1.973 Description A Cross-Site Scripting XSS issue exists via the Upload and Download feature. Recommendations For Webmin version 1.973, consider disabling the Upload and Download feature until a patch is available. Restrict...

CVE-2021-32158: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in Webmin 1.973 via the Upload and Download feature...

CVE-2021-32159: Cross-Site Request Forgery (CSRF)

A Cross-site request forgery CSRF vulnerability exists in Webmin 1.973 via the Upload and Download feature...

PT-2022-10068

Name of the Vulnerable Software and Affected Versions Webmin version 1.973 Description A Cross-site request forgery CSRF vulnerability exists in the Upload and Download feature. This issue allows an attacker to trick a user into performing unintended actions on the web application. Recommendation...

Webmin 1.900 Upload Authenticated Remote Command Execution Exploit

This Metasploit module exploits an arbitrary command execution vulnerability in Webmin 1.900 and lower versions. Any user authorized to the "Upload and Download" module can execute arbitrary commands with root privileges. In addition, if the Running Processes proc privilege is set the user can...

Design/Logic Flaw

Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI...

CVE-2019-9624

Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI...

PT-2019-4220

Name of the Vulnerable Software and Affected Versions Webmin version 1.900 Description The issue is related to insufficient access control in the Webmin control panel, allowing remote attackers to execute arbitrary code. This can be achieved by uploading a crafted .cgi file via the...

Webmin 1.900 Upload Execution

Webmin 1.900 allows authenticated users with “Upload and Download” module access to upload cgi files to a webroot subdirectory and the uploaded files can be executed by sending requests to the web server. Recent assessments: jrobles-r7 at May 09, 2019 5:57pm UTC reported: Details Webmin 1.900...