Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
131 results · page 1 of 3
Sep 29, 2026Webmin is a web-based system administration tool for Unix-like servers.CVE-2026-49243 · Other software · webmin · reported by GitHubCritical 9.6
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version 2.650.
- Product
- webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeaksec.github.iogithub.com
Jul 20, 2026Webmin is a web-based system administration tool for Unix-like servers.CVE-2026-42210 · Other software · webmin · reported by GitHubMedium 5.3
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. Webmin is a web-based system administration tool for Unix-like servers. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.
- Product
- webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requireCVE-2026-56022 · Other software · Webmin · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 6.9
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Jun 18, 2026Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.CVE-2026-56021 · Other software · Webmin · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 6.9
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Jun 18, 2026The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP CVE-2026-56020 · Other software · Webmin · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.2
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
May 27, 2026Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component.CVE-2026-49103 · Other software · Webmin · reported by MITRECritical 9.4
Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instCVE-2026-49102 · Other software · Webmin · reported by MITREMedium 6.1
Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe type (e.g., text/plain).
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2026Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allCVE-2026-22678 · Other software · Webmin · reported by VulnCheckMedium 5.1
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwebmin.comvulncheck.com
Dec 11, 2025squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments.CVE-2025-67738 · Other software · Webmin · reported by MITREHigh 8.5
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi).CVE-2025-61541 · Other software · Webmin · reported by MITREHigh 7.1
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2024Webmin CGI Command Injection Remote Code Execution Vulnerability.CVE-2024-12828 · Other software · Webmin · reported by zdi-disclosures@trendmicro.comHigh 8.8
Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of CGI requests. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22346.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Oct 16, 2024A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.CVE-2024-44762 · Other software · webmin · reported by MITREMedium 5.3
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.
- Product
- usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.CVE-2024-45692 · Other software · webmin · reported by MITREHigh 7.5
Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.
- Product
- webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820.CVE-2024-36453 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a webpage may be altered or sensitive information such as a credential may be disclosed.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003.CVE-2024-36452 · Other software · Webmin · reported by vultures@jpcert.or.jpLow 3.1
Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerability is exploited, unintended operations may be performed when a user views a malicious page while logged in. As a result, data within a system may be referred, a webpage may be altered, or a server may be permanently halted.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003.CVE-2024-36451 · Other software · Webmin · reported by vultures@jpcert.or.jpHigh 8.8
Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by an unauthorized user. As a result, data within a system may be referred, a webpage may be altered, or a server may be permanently halted.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910.CVE-2024-36450 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a session ID may be obtained, a webpage may be altered, or a server may be halted.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute CVE-2023-52046 · Other software · Webmin · reported by MITREMedium 4.8
Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute cron job as" tab Input field.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malCVE-2023-43309 · Other software · Webmin · reported by MITREMedium 4.8
There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2023Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name paCVE-2023-41157 · Other software · Webmin · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name parameter while creating the folder to manage the folder tab, filter tab, and forward mail tab.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting aCVE-2023-40983 · Other software · Webmin · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Find in Results file.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected intoCVE-2023-40982 · Other software · Webmin · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module name parameter.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTMCVE-2023-40986 · Other software · Webmin · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted payload injected into the Custom field.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023An issue was discovered in Webmin 2.100.CVE-2023-40985 · Other software · Webmin · reported by MITREMedium 5.4
An issue was discovered in Webmin 2.100. The File Manager functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when any file is searched/replaced.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting aCVE-2023-40984 · Other software · Webmin · reported by MITREMedium 5.4
A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML vCVE-2023-41160 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the key name field while adding an authorized key.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script CVE-2023-41159 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML by editing the forward file manually.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or CVE-2023-41156 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the save to new folder named field while creating a new filter.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML viaCVE-2023-41162 · Other software · Webmin · reported by MITREMedium 6.1
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the file mask field while searching under the tools drop down.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML CVE-2023-41158 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the description field while creating a new MIME type program.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitraryCVE-2023-41155 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the forward to field while creating a mail forwarding rule.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTMLCVE-2023-41154 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML CVE-2023-41152 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the handle program field while creating a new MIME type program.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2023Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment toCVE-2023-41161 · Other software · Webmin · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML viaCVE-2023-41163 · Other software · Webmin · reported by MITREMedium 6.1
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools drop down.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML vCVE-2023-41153 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via options for the host value while editing the host options.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023An issue was discovered in Webmin 2.021.CVE-2023-38311 · Other software · Webmin · reported by MITREMedium 5.4
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System Logs Viewer functionality. The vulnerability allows an attacker to store a malicious payload in the configuration field, triggering the execution of the payload when saving the configuration or when accessing the System Logs Viewer page.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023An issue was discovered in Webmin 2.021.CVE-2023-38310 · Other software · Webmin · reported by MITREMedium 5.4
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log files. This results in the execution of that payload whenever the affected log files are accessed.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023An issue was discovered in Webmin 2.021.CVE-2023-38309 · Other software · Webmin · reported by MITREMedium 6.1
An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the package search functionality. The vulnerability allows an attacker to inject a malicious payload in the "Search for Package" field, which gets reflected back in the application's response, leading to the execution of arbitrary JavaScript code within the context of the victim's browser.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023An issue was discovered in Webmin 2.021.CVE-2023-38308 · Other software · Webmin · reported by MITREMedium 6.1
An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitrary JavaScript code within the context of the victim's browser.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023An issue was discovered in Webmin 2.021.CVE-2023-38307 · Other software · Webmin · reported by MITREMedium 5.4
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023An issue was discovered in Webmin 2.021.CVE-2023-38306 · Other software · Webmin · reported by MITREMedium 6.1
An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is detected. However, by following certain steps, an attacker can bypass these restrictions and inject malicious code.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023An issue was discovered in Webmin 2.021.CVE-2023-38305 · Other software · Webmin · reported by MITREMedium 6.1
An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when the download link is accessed.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023An issue was discovered in Webmin 2.021.CVE-2023-38304 · Other software · Webmin · reported by MITREMedium 5.4
An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality, allowing an attacker to store a malicious payload in the Group Name field when creating a new group.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023An issue was discovered in Webmin 2.021.CVE-2023-38303 · Other software · Webmin · reported by MITREMedium 5.4
An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users and Group's real name parameter.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2022A vulnerability, which was classified as problematic, was found in Webmin 2.001.CVE-2022-3844 · Other software · Webmin · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.003 is able to address this issue. The patch is identified as d3d33af3c0c3fd3a889c84e287a038b7a457d811. It is recommended to upgrade the affected component. VDB-212862 is the identifier assigned to this vulnerability.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.CVE-2022-35132 · Other software · Webmin · reported by MITREHigh 8.8
Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2022The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message.CVE-2022-36880 · Other software · Webmin · reported by MITREMedium 6.1
The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.CVE-2022-36446 · Other software · Webmin · reported by MITRECritical 9.8
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 14, 2022Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or CCVE-2022-30708 · Other software · Webmin · reported by MITREHigh 8.8
Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.