Webmin

Records122All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical16CVSS 9.0–10.0

CVSS high29CVSS 7.0–8.9

Exploited now

Webmin records in CISA KEV

TI-2019-11278 Webmin Command Injection Vulnerability CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records

Webmin 96 records CRITICAL Usermin 22 records HIGH Userwin 1 record LOW

Records

122 records

TI-2019-11278 CVE-2019-15107 · GHSA-69hp-hrv4-rxrr

An issue was discovered in Webmin <=1.920.

CRITICAL 100KEV

An issue was discovered in Webmin <=1.920.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9971 Published 2019-08-16 No fix listed CWE-78

TI-2022-16770 CVE-2022-36446 · GHSA-3q8j-9w3h-v6p5

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

CRITICAL 86

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.95947 Published 2022-07-25 No fix listed CWE-116

TI-2022-00731 CVE-2022-0824 · GHSA-vw87-2p2h-8rp3

Improper Access Control to Remote Code Execution in webmin/webmin

HIGH 82

Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.96977 Published 2022-03-02 Fixed in 1.990 CWE-284

TI-2019-09619 CVE-2019-12840 · GHSA-gcq8-ggwj-2xvv

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute…

HIGH 77

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.77649 Published 2019-06-15 No fix listed CWE-78

TI-2015-01866 CVE-2015-2079 · GHSA-9wfx-p9gg-hp4f

Code injection in Usermin

HIGH 76

Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01562 Published 2025-04-28 Fixed in 1.660 CWE-96

TI-2022-15852 CVE-2022-35132 · GHSA-f29x-jxpj-xpfj

Usermin through 1.850 allows a remote authenticated user to execute OS commands via…

HIGH 73

Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02778 Published 2022-10-25 No fix listed CWE-78

TI-2021-11777 CVE-2021-31761 · GHSA-v8w5-257f-g592

Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote…

HIGH 66

Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.33569 Published 2021-04-25 No fix listed CWE-79

TI-2024-11888 CVE-2024-12828 · GHSA-r6m7-83vq-qx32

OS command injection in Webmin

HIGH 65

Webmin CGI Command Injection Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.33278 Published 2024-12-30 No fix listed CWE-78

TI-2020-07078 CVE-2020-8821 · GHSA-2gmj-rvcm-f6j2

An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting…

MEDIUM 64

An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.79056 Published 2020-10-12 No fix listed CWE-79

TI-2019-11737 CVE-2019-15642 · GHSA-wf78-9xpm-m77r

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted…

MEDIUM 64

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.36634 Published 2019-08-26 No fix listed CWE-94

TI-2024-29985 CVE-2024-44762 · GHSA-9jg2-v5f3-rqf2

A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100…

MEDIUM 63

A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02566 Published 2024-10-16 No fix listed CWE-209

TI-2006-03290 CVE-2006-3392 · GHSA-w4wx-r2h6-p94q

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before…

MEDIUM 63

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.79489 Published 2006-07-06 No fix listed

TI-2020-18103 CVE-2020-35606 · GHSA-vq42-23mp-rqh2

Arbitrary command execution can occur in Webmin through 1.962.

MEDIUM 61

Arbitrary command execution can occur in Webmin through 1.962.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.28048 Published 2020-12-21 No fix listed CWE-78

TI-2023-21637 CVE-2023-40983 · GHSA-455v-9mm3-9gjf

A reflected cross-site scripting (XSS) vulnerability in the File Manager function of…

MEDIUM 60

A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Find in Results file.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00609 Published 2023-09-15 No fix listed CWE-79

TI-2023-19707 CVE-2023-38309 · GHSA-wqmw-cmc2-6cf5

An issue was discovered in Webmin 2.021.

MEDIUM 60

An issue was discovered in Webmin 2.021.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00649 Published 2023-07-31 No fix listed CWE-79

TI-2023-19706 CVE-2023-38308 · GHSA-mw86-9j6v-q4x7

An issue was discovered in Webmin 2.021.

MEDIUM 60

An issue was discovered in Webmin 2.021.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00649 Published 2023-07-31 No fix listed CWE-79

TI-2023-19704 CVE-2023-38306 · GHSA-393c-4g2g-74rm

An issue was discovered in Webmin 2.021.

MEDIUM 60

An issue was discovered in Webmin 2.021.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00599 Published 2023-07-31 No fix listed CWE-79

TI-2023-19703 CVE-2023-38305 · GHSA-p32v-wxmw-472h

An issue was discovered in Webmin 2.021.

MEDIUM 60

An issue was discovered in Webmin 2.021.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00595 Published 2023-07-31 No fix listed CWE-79

TI-2003-00096 CVE-2003-0101 · GHSA-hm72-qxg7-34pg

miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly…

MEDIUM 59

miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which all…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.15469 Published 2003-02-26 No fix listed

TI-2023-21640 CVE-2023-40986 · GHSA-j32r-j9mg-wfm2

A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted payload injected into the Custom field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00475 Published 2023-09-15 No fix listed CWE-79

TI-2023-21639 CVE-2023-40985 · GHSA-m8xw-xh7f-gj9q

An issue was discovered in Webmin 2.100.

MEDIUM 58

An issue was discovered in Webmin 2.100.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00475 Published 2023-09-15 No fix listed CWE-79

TI-2023-21638 CVE-2023-40984 · GHSA-pg5c-r35w-x68r

A reflected cross-site scripting (XSS) vulnerability in the File Manager function of…

MEDIUM 58

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00475 Published 2023-09-15 No fix listed CWE-79

TI-2023-21636 CVE-2023-40982 · GHSA-rg8w-h73p-9cjx

A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module name parameter.