CVE-2023-38309

An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the package search functionality. The vulnerability allows an attacker to inject a malicious payload in the "Search for Package" field, which gets reflected back in the application's response, leading to the execution of arbitrary JavaScript code within the context of the victim's browser.

• CWE-79

• https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38309Exploit, Third Party Advisory
• https://webmin.com/tags/webmin-changelog/Release Notes
• https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38309Exploit, Third Party Advisory
• https://webmin.com/tags/webmin-changelog/Release Notes

Published

Jul 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38303An issue was discovered in Webmin 2.021. One can exploit a s…5.4
• CVE-2023-38304An issue was discovered in Webmin 2.021. A Stored Cross-Site…5.4
• CVE-2023-38305An issue was discovered in Webmin 2.021. The download functi…6.1
• CVE-2023-38306An issue was discovered in Webmin 2.021. A Cross-site Script…6.1
• CVE-2023-38307An issue was discovered in Webmin 2.021. A Stored Cross-Site…5.4
• CVE-2023-38308An issue was discovered in Webmin 2.021. A Cross-Site Script…6.1
• CVE-2023-3831A vulnerability was found in Bug Finder Finounce 1.0 and cla…5.4
• CVE-2023-38310An issue was discovered in Webmin 2.021. A Stored Cross-Site…5.4
• CVE-2023-38311An issue was discovered in Webmin 2.021. A Stored Cross-Site…5.4
• CVE-2023-38312A directory traversal vulnerability in Valve Counter-Strike …7.5
• CVE-2023-38313An issue was discovered in OpenNDS Captive Portal before 10.…7.5
• CVE-2023-38314An issue was discovered in OpenNDS Captive Portal before ver…6.5