← Back

Webmin

webmin

Vendor: Webmin • 94 CVEs

CVEs (94)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-38308
1Webmin
1Webmin
Nov 21, 2024
Jul 31, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party dom...Show more
An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitrary JavaScript code within the context of the victim's browser.Show less
CVE-2023-38307
1Webmin
1Webmin
Nov 21, 2024
Jul 31, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and ins...Show more
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name.Show less
CVE-2023-38306
1Webmin
1Webmin
Nov 21, 2024
Jul 31, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .sv...Show more
An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is detected. However, by following certain steps, an attacker can bypass these restrictions and inject malicious code.Show less
CVE-2023-38305
1Webmin
1Webmin
Nov 21, 2024
Jul 31, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attack...Show more
An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when the download link is accessed.Show less
CVE-2023-38304
1Webmin
1Webmin
Nov 21, 2024
Jul 31, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality, allowing an attacker to store a malicious payload in the Group Name field w...Show more
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality, allowing an attacker to store a malicious payload in the Group Name field when creating a new group.Show less
CVE-2023-38303
1Webmin
1Webmin
Nov 21, 2024
Jul 31, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users and Group's real name parameter.
CVE-2022-3844
1Webmin
1Webmin
Nov 21, 2024
Nov 2, 2022
N/A· v4
6.1 MEDIUM· v3
4.0 MEDIUM· v2
A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation leads to basic cross site scripting. It is possible to launch...Show more
A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.003 is able to address this issue. The patch is identified as d3d33af3c0c3fd3a889c84e287a038b7a457d811. It is recommended to upgrade the affected component. VDB-212862 is the identifier assigned to this vulnerability.Show less
CVE-2022-36880
1Webmin
2Usermin
Webmin
Nov 21, 2024
Jul 27, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message.
CVE-2022-36446
1Webmin
1Webmin
Nov 21, 2024
Jul 25, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
CVE-2022-30708
1Webmin
1Webmin
Nov 21, 2024
May 15, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does...Show more
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.Show less
CVE-2021-32162
1Webmin
1Webmin
Nov 21, 2024
Apr 11, 2022
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.
CVE-2021-32161
1Webmin
1Webmin
Nov 21, 2024
Apr 11, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.
CVE-2021-32160
1Webmin
1Webmin
Nov 21, 2024
Apr 11, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.
CVE-2021-32159
1Webmin
1Webmin
Nov 21, 2024
Apr 11, 2022
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
CVE-2021-32158
1Webmin
1Webmin
Nov 21, 2024
Apr 11, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
CVE-2021-32157
1Webmin
1Webmin
Nov 21, 2024
Apr 11, 2022
N/A· v4
9.6 CRITICAL· v3
6.8 MEDIUM· v2
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
CVE-2021-32156
1Webmin
1Webmin
Nov 21, 2024
Apr 11, 2022
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
CVE-2022-0829
1Webmin
1Webmin
Nov 21, 2024
Mar 2, 2022
N/A· v4
8.1 HIGH· v3
5.5 MEDIUM· v2
Improper Authorization in GitHub repository webmin/webmin prior to 1.990.
CVE-2022-0824
1Webmin
1Webmin
Nov 21, 2024
Mar 2, 2022
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.
CVE-2021-31762
1Webmin
1Webmin
Nov 21, 2024
Apr 25, 2021
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running process feature.