CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 31/07/2023 |
| CVE-2023-38307 | MÉDIO5.4 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerability occurs when an authenticated user adds a new user and inserts an XSS payload into the user's real name. | 31/07/2023 |
| CVE-2023-38306 | MÉDIO6.1 | An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is detected. However, by foll | 31/07/2023 |
| CVE-2023-38305 | MÉDIO6.1 | An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when | 31/07/2023 |
| CVE-2023-38304 | MÉDIO5.4 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality, allowing an attacker to store a malicious payload in the Group Name field when creating a new group. | 31/07/2023 |
| CVE-2023-38303 | MÉDIO5.4 | An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users and Group's real name parameter. | 31/07/2023 |
| CVE-2022-3844 | MÉDIO6.1 | A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.003 is able to address this issue. The patch is identif | 02/11/2022 |
| CVE-2022-36880 | MÉDIO6.1 | The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message. | 27/07/2022 |
| CVE-2022-36446 | CRÍTICO9.8 | software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. | 25/07/2022 |
| CVE-2022-30708 | ALTO8.8 | Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter. | 15/05/2022 |
| CVE-2021-32162 | ALTO8.8 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature. | 11/04/2022 |
| CVE-2021-32161 | MÉDIO6.1 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature. | 11/04/2022 |
| CVE-2021-32160 | MÉDIO6.1 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature. | 11/04/2022 |
| CVE-2021-32159 | ALTO8.8 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature. | 11/04/2022 |
| CVE-2021-32158 | MÉDIO6.1 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature. | 11/04/2022 |
| CVE-2021-32157 | CRÍTICO9.6 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature. | 11/04/2022 |
| CVE-2021-32156 | ALTO8.8 | A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature. | 11/04/2022 |
| CVE-2022-0829 | ALTO8.1 | Improper Authorization in GitHub repository webmin/webmin prior to 1.990. | 02/03/2022 |