CVE-2023-38306

An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the application restricts the upload of certain file types such as .svg, .php, etc., and displays an error message if a prohibited file type is detected. However, by following certain steps, an attacker can bypass these restrictions and inject malicious code.

• CWE-79

• https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38306Exploit, Third Party Advisory
• https://webmin.com/tags/webmin-changelog/Release Notes
• https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38306Exploit, Third Party Advisory
• https://webmin.com/tags/webmin-changelog/Release Notes

Published

Jul 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38300A certain software build for the Orbic Maui device (Orbic/RC…6.2
• CVE-2023-38301An issue was discovered in a third-party component related t…3.4
• CVE-2023-38302A certain software build for the Sharp Rouvo V device (SHARP…4.3
• CVE-2023-38303An issue was discovered in Webmin 2.021. One can exploit a s…5.4
• CVE-2023-38304An issue was discovered in Webmin 2.021. A Stored Cross-Site…5.4
• CVE-2023-38305An issue was discovered in Webmin 2.021. The download functi…6.1
• CVE-2023-38307An issue was discovered in Webmin 2.021. A Stored Cross-Site…5.4
• CVE-2023-38308An issue was discovered in Webmin 2.021. A Cross-Site Script…6.1
• CVE-2023-38309An issue was discovered in Webmin 2.021. A Reflected Cross-S…6.1
• CVE-2023-3831A vulnerability was found in Bug Finder Finounce 1.0 and cla…5.4
• CVE-2023-38310An issue was discovered in Webmin 2.021. A Stored Cross-Site…5.4
• CVE-2023-38311An issue was discovered in Webmin 2.021. A Stored Cross-Site…5.4