CVE-2007-3156

MEDIUM 4.3CVE-2007-3156 · Published 11/06/2007 · updated 16/06/2026

In short

CVE-2007-3156 is a MEDIUM (CVSS 4.3) vulnerability affecting usermin (webmin), webmin (webmin).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
usermin webmin	`≤ 1.280`	No fix yet
webmin webmin	`≤ 1.340`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in pam_login.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) message, or (3) question parameter. NOTE: some of these details are obtained from third party information.

References

osvdb.org/36932
secunia.com/advisories/25580 · Patch
secunia.com/advisories/25785 · Vendor Advisory
secunia.com/advisories/25956 · Vendor Advisory
security.gentoo.org/glsa/glsa-200707-05.xml
mandriva.com/security/advisories
securityfocus.com/bid/24381 · Patch
vupen.com/english/advisories/2007/2117 · Vendor Advisory
webmin.com/changes-1.350.html
webmin.com/security.html

More vulnerabilities in usermin

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

usermin

webmin

≤ 1.280

No fix yet

webmin

≤ 1.340

No fix yet

Description

More vulnerabilities in usermin

See all →