CVE-2023-38309

CVE-2023-38309 affects Webmin 2.021 and describes a Reflected Cross-Site Scripting (XSS) vulnerability in the package search feature. An attacker can inject a payload in the "Search for Package" field, which is reflected in the response and can execute arbitrary JavaScript in the victim’s browser...

CVE-2023-38305

Webmin 2.021 contains a Cross‑Site Scripting (XSS) vulnerability in the download functionality. By providing a crafted download path with a malicious payload, an attacker can inject arbitrary code that executes in the victim’s browser when the download link is accessed. Adjacent sources (Red Hat,...

CVE-2023-38310

CVE-2023-38310 affects Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability exists in the configuration settings of the system logs functionality, allowing an attacker to store an XSS payload in log-file configuration. The payload can execute whenever the affected log files are accesse...

CVE-2023-38304

An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting XSS vulnerability was discovered in the Users and Groups functionality, allowing an attacker to store a malicious payload in the Group Name field when creating a new group...

CVE-2023-38308

An issue was discovered in Webmin 2.021. A Cross-Site Scripting XSS vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitra...

CVE-2023-38308

An issue was discovered in Webmin 2.021. A Cross-Site Scripting XSS vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitra...

CVE-2023-38304

Webmin 2.021 has a Stored XSS in the Users and Groups functionality, enabling a malicious payload to be stored in the Group Name field when creating a new group. The issue is documented across multiple sources (including PT-2023-4161 and CVE-2023-38304) with a CVSSv3.1 base score of 5.4 (Medium)....

Webmin cross-site scripting vulnerabilities

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin version 2.021, which stems from a Stored Cross-Site Scripting XSS vulnerability found in the configuration settings of the system logging...

CVE-2023-38310: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting XSS vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log files. This results in...

CVE-2023-38306

CVE-2023-38306 affects Webmin 2.021. The vulnerability is a Cross-site Scripting (XSS) bypass in the file upload functionality, where the app’s restrictions on certain file types (e.g., .svg, .php) can be bypassed by following specific steps, allowing an attacker to inject malicious code. The roo...

Exploit for OS Command Injection in Webmin

CVE-2019-15107 - Webmin RCE 💻🛑 The vulnerability is found in...

SUSE CVE-2005-3042

miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters line feed or carriage return...

SUSE CVE-2005-3912

Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service crash or memory consumption and possibly execute arbitrary code via format string specifiers in the usernam...

Webmin < 1.970 Remote Command Execution

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.970. It is, therefore, affected by a Remote Command Execution Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No...

Webmin < 1.974 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.974. It is, therefore, affected by multiple vulnerabilities. - A Cross Site Request Forgery CSRF that allow to achieve Remote Command Execution RCE through Webmin running process feature. - A...

Webmin < 1.991 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.991. It is, therefore, affected by a Remote Code Execution Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No...

Webmin < 1.940 XML External Entity

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.940. It is, therefore, affected by an XML External Entity vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

Webmin < 2.003 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 2.003. It is, therefore, affected by a multiples vulnerabilities : - A Cross-Site Scripting via the Cluster Cron Job tab Input field - A Cross-Site Scripting in an unknown function of the file...

Webmin < 1.950 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.950. It is, therefore, affected by multiple vulnerabilities. - An Improper Data Validation Vulnerability affecting the Command Shell Endpoint. - A Cross-Site Scripting affecting the save function of...

Webmin < 1.996 Cross-Site Scripting

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.996. It is, therefore, affected by a Cross-Site Scripting Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No sour...