CVE-2023-38304

An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting XSS vulnerability was discovered in the Users and Groups functionality, allowing an attacker to store a malicious payload in the Group Name field when creating a new group...

CVE-2023-38310

An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting XSS vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log files. This results in...

CVE-2023-38303

An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting XSS attack to achieve Remote Command Execution RCE through the Users and Group's real name parameter...

CVE-2023-38308

An issue was discovered in Webmin 2.021. A Cross-Site Scripting XSS vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitra...

CVE-2023-38305

Webmin 2.021 contains a Cross‑Site Scripting (XSS) vulnerability in the download functionality. By providing a crafted download path with a malicious payload, an attacker can inject arbitrary code that executes in the victim’s browser when the download link is accessed. Adjacent sources (Red Hat,...

CVE-2023-38309

An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting XSS vulnerability was discovered in the package search functionality. The vulnerability allows an attacker to inject a malicious payload in the "Search for Package" field, which gets reflected back in the application's...

Exploit for OS Command Injection in Webmin

CVE-2019-15107 - Webmin RCE 💻🛑 The vulnerability is found in...

SUSE CVE-2005-3042

miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters line feed or carriage return...

SUSE CVE-2005-3912

Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service crash or memory consumption and possibly execute arbitrary code via format string specifiers in the usernam...

Webmin < 2.003 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 2.003. It is, therefore, affected by a multiples vulnerabilities : - A Cross-Site Scripting via the Cluster Cron Job tab Input field - A Cross-Site Scripting in an unknown function of the file...

Webmin < 1.991 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.991. It is, therefore, affected by a Remote Code Execution Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No...

Webmin < 1.990 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.990. It is, therefore, affected by multiple vulnerabilities. - Improper Access Control to Remote Code Execution - Improper Authorization Note that the scanner has not tested for these issues but has...

Webmin < 1.950 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.950. It is, therefore, affected by multiple vulnerabilities. - An Improper Data Validation Vulnerability affecting the Command Shell Endpoint. - A Cross-Site Scripting affecting the save function of...

Webmin < 1.974 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.974. It is, therefore, affected by multiple vulnerabilities. - A Cross Site Request Forgery CSRF that allow to achieve Remote Command Execution RCE through Webmin running process feature. - A...

Webmin < 1.920 Remote Command Execution

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.920. It is, therefore, affected by a Remote Command Execution Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No...

Webmin < 1.910 Remote Command Execution

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.910. It is, therefore, affected by a Remote Command Execution Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No...

Webmin < 1.940 XML External Entity

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.940. It is, therefore, affected by an XML External Entity vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

Webmin < 1.997 Remote Code Execution

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.997. It is, therefore, affected by a Remote Code Execution Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No...

Webmin < 1.930 Remote Command Execution

According to its self-reported version, the Webmin install hosted on the remote host is 1.890 to 1.920. It is, therefore, affected by a remote command execution vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported...

Webmin < 1.970 Remote Command Execution

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.970. It is, therefore, affected by a Remote Command Execution Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No...