CVE-2023-38305

An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting XSS vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the...

CVE-2023-38307

Webmin 2.021 contains a Stored XSS in Users and Groups when adding a new user and injecting payload into the real name. Root cause is tied to insufficient protection of the web page structure, enabling an attacker with authenticated access to execute script in victims’ browsers. Exploitation deta...

CVE-2023-38307

An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting XSS vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name...

Webmin 跨站脚本漏洞

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin version 2.021 that stems from the discovery of a Stored Cross-Site Scripting XSS vulnerability in the Users and Groups feature. The...

CVE-2023-38311

An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting XSS vulnerability was discovered in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the payload when saving the...

CVE-2023-38306

An issue was discovered in Webmin 2.021. A Cross-site Scripting XSS Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is...

Webmin 跨站脚本漏洞

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin version 2.021, which stems from a Stored Cross-Site Scripting XSS vulnerability found in the configuration settings of the system logging...

CVE-2023-38310

An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting XSS vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log files. This results in...

CVE-2023-38305

Webmin 2.021 contains a Cross‑Site Scripting (XSS) vulnerability in the download functionality. By providing a crafted download path with a malicious payload, an attacker can inject arbitrary code that executes in the victim’s browser when the download link is accessed. Adjacent sources (Red Hat,...

CVE-2023-38305

An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting XSS vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the...

Exploit for OS Command Injection in Webmin

CVE-2019-15107 - Webmin RCE 💻🛑 The vulnerability is found in...

SUSE CVE-2005-3042

miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters line feed or carriage return...

SUSE CVE-2005-3912

Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service crash or memory consumption and possibly execute arbitrary code via format string specifiers in the usernam...

Webmin < 1.990 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.990. It is, therefore, affected by multiple vulnerabilities. - Improper Access Control to Remote Code Execution - Improper Authorization Note that the scanner has not tested for these issues but has...

Webmin < 1.940 XML External Entity

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.940. It is, therefore, affected by an XML External Entity vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

Webmin < 2.003 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 2.003. It is, therefore, affected by a multiples vulnerabilities : - A Cross-Site Scripting via the Cluster Cron Job tab Input field - A Cross-Site Scripting in an unknown function of the file...

Webmin < 1.996 Cross-Site Scripting

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.996. It is, therefore, affected by a Cross-Site Scripting Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No sour...

Webmin < 1.974 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.974. It is, therefore, affected by multiple vulnerabilities. - A Cross Site Request Forgery CSRF that allow to achieve Remote Command Execution RCE through Webmin running process feature. - A...

Webmin < 1.991 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.991. It is, therefore, affected by a Remote Code Execution Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No...

Webmin < 1.970 Remote Command Execution

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.970. It is, therefore, affected by a Remote Command Execution Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No...