CVE-2022-36446

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

• CWE-116

• http://packetstormsecurity.com/files/167894/Webmin-1.996-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/168049/Webmin-Package-Updates-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://gist.github.com/emirpolatt/cf19d6c0128fa3e25ebb47e09243919bExploit, Third Party Advisory
• https://github.com/webmin/webmin/commit/13f7bf9621a82d93f1e9dbd838d1e22020221bdePatch, Third Party Advisory
• https://github.com/webmin/webmin/compare/1.996...1.997Release Notes, Third Party Advisory
• https://www.exploit-db.com/exploits/50998Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/167894/Webmin-1.996-Remote-Code-Execution.htmlThird Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/168049/Webmin-Package-Updates-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://gist.github.com/emirpolatt/cf19d6c0128fa3e25ebb47e09243919bExploit, Third Party Advisory
• https://github.com/webmin/webmin/commit/13f7bf9621a82d93f1e9dbd838d1e22020221bdePatch, Third Party Advisory
• https://github.com/webmin/webmin/compare/1.996...1.997Release Notes, Third Party Advisory
• https://www.exploit-db.com/exploits/50998Third Party Advisory, VDB Entry

Published

Jul 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3644The collection remote for pulp_ansible stores tokens in plai…5.5
• CVE-2022-36440A reachable assertion was found in Frrouting frr-bgpd 8.3.0 …7.5
• CVE-2022-36441An issue was discovered in Zebra Enterprise Home Screen 4.1.…7.1
• CVE-2022-36442An issue was discovered in Zebra Enterprise Home Screen 4.1.…5.5
• CVE-2022-36443An issue was discovered in Zebra Enterprise Home Screen 4.1.…7.8
• CVE-2022-36444An issue was discovered in Atos Unify OpenScape SBC 9 and 10…9.8
• CVE-2022-36447An inflation issue was discovered in Chia Network CAT1 Stand…7.5
• CVE-2022-36448An issue was discovered in Insyde InsydeH2O with kernel 5.0 …8.2
• CVE-2022-36449An issue was discovered in the Arm Mali GPU Kernel Driver. A…6.5
• CVE-2022-36450Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://h…9.8
• CVE-2022-36451A vulnerability in the MiCollab Client server component of M…8.8
• CVE-2022-36452A vulnerability in the web conferencing component of Mitel M…9.8