CVE-2017-15646

Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload that will lead to Remote Code Execution, as demonstrated by an OS command in the value attribute of a name='cmd' input element.

• CWE-79

• http://www.webmin.com/changes.htmlRelease Notes, Vendor Advisory
• http://www.webmin.com/security.htmlVendor Advisory
• https://blogs.securiteam.com/index.php/archives/3430Exploit, Third Party Advisory
• https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9Patch, Third Party Advisory
• http://www.webmin.com/changes.htmlRelease Notes, Vendor Advisory
• http://www.webmin.com/security.htmlVendor Advisory
• https://blogs.securiteam.com/index.php/archives/3430Exploit, Third Party Advisory
• https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9Patch, Third Party Advisory

Published

Oct 19, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1564IBM Rational Quality Manager and IBM Rational Collaborative …5.4
• CVE-2017-15640app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS v…
• CVE-2017-15642In lsx_aiffstartread in aiff.c in Sound eXchange (SoX) 14.4.…
• CVE-2017-15643An active network attacker (MiTM) can achieve remote code ex…
• CVE-2017-15644SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link…
• CVE-2017-15645CSRF exists in Webmin 1.850. By sending a GET request to at/…
• CVE-2017-15647On FiberHome routers, Directory Traversal exists in /cgi-bin…
• CVE-2017-15648In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XS…
• CVE-2017-15649net/packet/af_packet.c in the Linux kernel before 4.13.6 all…
• CVE-2017-1565IBM Rational Quality Manager and IBM Rational Collaborative …5.4
• CVE-2017-15650musl libc before 1.1.17 has a buffer overflow via crafted DN…
• CVE-2017-15651PRTG Network Monitor 17.3.33.2830 allows remote authenticate…