Unscored severity · published Mar 16, 2014
CVE-2014-0339
Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter
–
CVSS
1.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmin · Webmin
through 1.670; 1.600; 1.610; 1.620; 1.630; 1.640; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0339
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0339
Exploit
http://seclists.org/fulldisclosure/2014/Mar/274
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21679713
US Government Resource
http://www.kb.cert.org/vuls/id/381692
Exploit
http://www.securityfocus.com/bid/66248
www.webmin.com
http://www.webmin.com/changes.html
More from Webmin
9.8
CVE-2019-15107
Webmin Command Injection Vulnerability
9.8
CVE-2022-36446
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command
9.8
CVE-2020-35769
miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program
9.8
CVE-2018-8712
An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled
9.6
CVE-2026-49243
Webmin: Reflected XSS in the Configuration module