CVE-2024-36453

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a webpage may be altered or sensitive information such as a credential may be disclosed.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-364545.3Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 a CVE-2024-364559.4An improper input validation allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by sending a CVE-2024-364569.4This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a speciall CVE-2024-364575.3The vulnerability allows an attacker to bypass the authentication requirements for a specific PAM endpoint.CVE-2024-364585.1The vulnerability allows a malicious low-privileged PAM user to perform server upgrade related actions.CVE-2024-364598.4A CRLF cross-site scripting vulnerability has been identified in certain configurations of the SiteMinder Web Agent for IIS Web Server and S CVE-2024-36467.2A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management CVE-2024-364608.1The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text.CVE-2024-364618.8Within Zabbix, users have the ability to directly modify memory pointers in the JavaScript engine.CVE-2024-364627.5Uncontrolled resource consumption refers to a software vulnerability where a attacker or system uses excessive resources, such as CPU, memor CVE-2024-364638.8The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objec CVE-2024-364642.7When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have