Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330…
Priority LOW 21CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename.
Why it matters now
EPSS 0.00625 50th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 44
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:usermin:usermin:1.000:*:*:*:*:*:*:* | 1.000 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.010:*:*:*:*:*:*:* | 1.010 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.020:*:*:*:*:*:*:* | 1.020 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.030:*:*:*:*:*:*:* | 1.030 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.040:*:*:*:*:*:*:* | 1.040 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.051:*:*:*:*:*:*:* | 1.051 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.060:*:*:*:*:*:*:* | 1.060 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.070:*:*:*:*:*:*:* | 1.070 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.080:*:*:*:*:*:*:* | 1.080 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.090:*:*:*:*:*:*:* | 1.090 | Vulnerable | Usermin |
- cpe:2.3:a:usermin:usermin:1.000:*:*:*:*:*:*:* Versions 1.000 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.010:*:*:*:*:*:*:* Versions 1.010 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.020:*:*:*:*:*:*:* Versions 1.020 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.030:*:*:*:*:*:*:* Versions 1.030 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.040:*:*:*:*:*:*:* Versions 1.040 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.051:*:*:*:*:*:*:* Versions 1.051 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.060:*:*:*:*:*:*:* Versions 1.060 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.070:*:*:*:*:*:*:* Versions 1.070 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.080:*:*:*:*:*:*:* Versions 1.080 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.090:*:*:*:*:*:*:* Versions 1.090 Vulnerable ·Usermin
Show 34 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:usermin:usermin:1.100:*:*:*:*:*:*:* | 1.100 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.110:*:*:*:*:*:*:* | 1.110 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.120:*:*:*:*:*:*:* | 1.120 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.130:*:*:*:*:*:*:* | 1.130 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.140:*:*:*:*:*:*:* | 1.140 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.150:*:*:*:*:*:*:* | 1.150 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.210:*:*:*:*:*:*:* | 1.210 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.220:*:*:*:*:*:*:* | 1.220 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.230:*:*:*:*:*:*:* | 1.230 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.240:*:*:*:*:*:*:* | 1.240 | Vulnerable | Usermin |
| cpe:2.3:a:usermin:usermin:1.250:*:*:*:*:*:*:* | 1.250 | Vulnerable | Usermin |
| cpe:2.3:a:webmin:webmin:1.0.00:*:*:*:*:*:*:* | 1.0.00 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.0.10:*:*:*:*:*:*:* | 1.0.10 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.0.20:*:*:*:*:*:*:* | 1.0.20 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.0.30:*:*:*:*:*:*:* | 1.0.30 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.0.40:*:*:*:*:*:*:* | 1.0.40 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.0.50:*:*:*:*:*:*:* | 1.0.50 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.0.51:*:*:*:*:*:*:* | 1.0.51 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.0.60:*:*:*:*:*:*:* | 1.0.60 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.0.70:*:*:*:*:*:*:* | 1.0.70 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.0.80:*:*:*:*:*:*:* | 1.0.80 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.0.90:*:*:*:*:*:*:* | 1.0.90 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.1.00:*:*:*:*:*:*:* | 1.1.00 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.1.10:*:*:*:*:*:*:* | 1.1.10 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.1.20:*:*:*:*:*:*:* | 1.1.20 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.1.21:*:*:*:*:*:*:* | 1.1.21 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.1.30:*:*:*:*:*:*:* | 1.1.30 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.1.40:*:*:*:*:*:*:* | 1.1.40 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.1.50:*:*:*:*:*:*:* | 1.1.50 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.2.20:*:*:*:*:*:*:* | 1.2.20 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.2.30:*:*:*:*:*:*:* | 1.2.30 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.2.40:*:*:*:*:*:*:* | 1.2.40 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.2.50:*:*:*:*:*:*:* | 1.2.50 | Vulnerable | Webmin |
| cpe:2.3:a:webmin:webmin:1.3.20:*:*:*:*:*:*:* | 1.3.20 | Vulnerable | Webmin |
- cpe:2.3:a:usermin:usermin:1.100:*:*:*:*:*:*:* Versions 1.100 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.110:*:*:*:*:*:*:* Versions 1.110 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.120:*:*:*:*:*:*:* Versions 1.120 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.130:*:*:*:*:*:*:* Versions 1.130 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.140:*:*:*:*:*:*:* Versions 1.140 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.150:*:*:*:*:*:*:* Versions 1.150 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.210:*:*:*:*:*:*:* Versions 1.210 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.220:*:*:*:*:*:*:* Versions 1.220 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.230:*:*:*:*:*:*:* Versions 1.230 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.240:*:*:*:*:*:*:* Versions 1.240 Vulnerable ·Usermin
- cpe:2.3:a:usermin:usermin:1.250:*:*:*:*:*:*:* Versions 1.250 Vulnerable ·Usermin
- cpe:2.3:a:webmin:webmin:1.0.00:*:*:*:*:*:*:* Versions 1.0.00 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.0.10:*:*:*:*:*:*:* Versions 1.0.10 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.0.20:*:*:*:*:*:*:* Versions 1.0.20 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.0.30:*:*:*:*:*:*:* Versions 1.0.30 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.0.40:*:*:*:*:*:*:* Versions 1.0.40 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.0.50:*:*:*:*:*:*:* Versions 1.0.50 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.0.51:*:*:*:*:*:*:* Versions 1.0.51 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.0.60:*:*:*:*:*:*:* Versions 1.0.60 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.0.70:*:*:*:*:*:*:* Versions 1.0.70 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.0.80:*:*:*:*:*:*:* Versions 1.0.80 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.0.90:*:*:*:*:*:*:* Versions 1.0.90 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.1.00:*:*:*:*:*:*:* Versions 1.1.00 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.1.10:*:*:*:*:*:*:* Versions 1.1.10 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.1.20:*:*:*:*:*:*:* Versions 1.1.20 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.1.21:*:*:*:*:*:*:* Versions 1.1.21 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.1.30:*:*:*:*:*:*:* Versions 1.1.30 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.1.40:*:*:*:*:*:*:* Versions 1.1.40 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.1.50:*:*:*:*:*:*:* Versions 1.1.50 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.2.20:*:*:*:*:*:*:* Versions 1.2.20 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.2.30:*:*:*:*:*:*:* Versions 1.2.30 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.2.40:*:*:*:*:*:*:* Versions 1.2.40 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.2.50:*:*:*:*:*:*:* Versions 1.2.50 Vulnerable ·Webmin
- cpe:2.3:a:webmin:webmin:1.3.20:*:*:*:*:*:*:* Versions 1.3.20 Vulnerable ·Webmin
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2007-1276
- 2026-10-03 Alias added: GHSA-x949-g274-2xvm
- 2026-11-03 EPSS moved to the 50th–90th percentile
References
Sources
- CVE-2007-1276 · CVE Program
- CVE-2007-1276 · NVD
- FIRST EPSS
- GHSA-x949-g274-2xvm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences