{"id":"CVE-2017-9313","aliases":["EUVD-2017-18248","GHSA-93m5-952c-4mxx"],"status":"published","title":"Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers...","description":"Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0139,"percentile":0.72497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2017-07-04T02:00:00Z","modified":"2026-10-20T10:49:35Z","products":[{"vendor":"webmin","product":"webmin"}],"references":[{"url":"https://github.com/webmin/webmin/commit/a330e913ee099cb9c586ce1b9267647fc566c1ab","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://seclists.org/bugtraq/2017/Jul/3","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://www.securitytracker.com/id/1038814","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/webmin/webmin/commit/c2d4a90639afb2403979aa91ba75cb332ae16d1b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/99373","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.webmin.com/changes.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9313"},{"url":"https://github.com/advisories/GHSA-93m5-952c-4mxx"}],"sources":{"cve":[{"id":"CVE-2017-9313","description":"Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.","status":"published","published":"2017-07-04T02:00:00Z","modified":"2024-08-05T17:02:44.374Z","updated_at":"2026-11-02T14:33:13.96587Z"}],"euvd":[{"id":"EUVD-2017-18248","description":"Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.","status":"published","published":"2017-07-04T02:00:00Z","modified":"2024-08-05T17:02:44Z","updated_at":"2026-11-03T02:23:28.642509Z"}],"ghsa":[{"id":"GHSA-93m5-952c-4mxx","title":"Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers...","description":"Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.","status":"published","published":"2022-05-17T02:33:36Z","modified":"2023-01-27T05:05:05Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:42:37.253278Z"}],"nvd":[{"id":"CVE-2017-9313","description":"Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.","status":"published","published":"2017-07-04T02:29:00.283Z","modified":"2026-06-17T01:27:52.387Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:51.893212Z"}],"osv":[{"id":"CVE-2017-9313","description":"Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.","status":"published","published":"2017-07-04T02:29:00.283Z","modified":"2026-10-20T10:49:35.461423705Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:06.868403Z"}]}}