CVE-2017-9313

Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.

• CWE-79

• http://seclists.org/bugtraq/2017/Jul/3Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/99373Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038814Third Party Advisory, VDB Entry
• http://www.webmin.com/changes.htmlRelease Notes, Vendor Advisory
• https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1abPatch, Third Party Advisory
• https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1bPatch, Third Party Advisory
• http://seclists.org/bugtraq/2017/Jul/3Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/99373Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038814Third Party Advisory, VDB Entry
• http://www.webmin.com/changes.htmlRelease Notes, Vendor Advisory
• https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1abPatch, Third Party Advisory
• https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1bPatch, Third Party Advisory

Published

Jul 4, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9304libyara/re.c in the regexp module in YARA 3.5.0 allows remot…
• CVE-2017-9305lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupwar…
• CVE-2017-9306inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote at…
• CVE-2017-9307SSRF vulnerability in remotedownload.php in Allen Disk 1.6 a…
• CVE-2017-9310QEMU (aka Quick Emulator), when built with the e1000e NIC em…5.6
• CVE-2017-9312Improperly implemented option-field processing in the TCP/IP…
• CVE-2017-9314Authentication vulnerability found in Dahua NVR models NVR50…
• CVE-2017-9315Customer of Dahua IP camera or IP PTZ could submit relevant …
• CVE-2017-9316Firmware upgrade authentication bypass vulnerability was fou…
• CVE-2017-9317Privilege escalation vulnerability found in some Dahua IP de…
• CVE-2017-9321Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-9322Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…