Description
Multiple cross-site scripting (XSS) vulnerabilities in pam_login.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) message, or (3) question parameter. NOTE: some of these details are obtained from third party information.
References
- http://www.webmin.com/security.html
- 25785 third-party-advisory
- ADV-2007-2117 vdb-entry
- 24381 vdb-entry
- http://www.webmin.com/changes-1.350.html
- GLSA-200707-05 vendor-advisory
- 25580 third-party-advisory
- 36932 vdb-entry
- MDKSA-2007:135 vendor-advisory
- 25956 third-party-advisory