Priority LOW 31
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00476 · Published 2026-06-18 · No fix listed CWE-185
Priority LOW 31
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00555 · Published 2026-06-18 · Fixed in 2.640 CWE-308
Priority LOW 23
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitr…
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00221 · Published 2026-05-21 · Fixed in 2.641 CWE-79
Priority LOW 34
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi).
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.0046 · Published 2025-10-16 · No fix listed CWE-284
Priority HIGH 65
Webmin CGI Command Injection Remote Code Execution Vulnerability.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.33278 · Published 2024-12-30 · No fix listed CWE-78
Priority MEDIUM 40
Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00623 · Published 2024-09-04 · No fix listed CWE-835
Priority LOW 27
Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.004 · Published 2024-07-10 · Fixed in 1.970, 1.820 CWE-79
Priority LOW 14
Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003.
CVSS 3.1LOW 3.1· Network · No auth · User interaction · EPSS 0.00176 · Published 2024-07-10 · Fixed in 2.003 CWE-352
Priority MEDIUM 41
Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00569 · Published 2024-07-10 · Fixed in 2.003 CWE-280
Priority LOW 24
Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00303 · Published 2024-07-10 · Fixed in 1.910 CWE-79
Priority MEDIUM 55
Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute cron job as" tab Input field.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00566 · Published 2024-01-25 · No fix listed CWE-79
Priority MEDIUM 55
There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00457 · Published 2023-09-21 · No fix listed CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted payload injected into the Custom field.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00475 · Published 2023-09-15 · No fix listed CWE-79
Priority MEDIUM 58
An issue was discovered in Webmin 2.100.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00475 · Published 2023-09-15 · No fix listed CWE-79
Priority MEDIUM 58
A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00475 · Published 2023-09-15 · No fix listed CWE-79
Priority MEDIUM 60
A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Find in Results file.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00609 · Published 2023-09-15 · No fix listed CWE-79
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module name parameter.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00494 · Published 2023-09-15 · No fix listed CWE-79
Priority LOW 25
A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the forward to field while creating…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00537 · Published 2023-09-13 · No fix listed CWE-79
Priority LOW 28
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results un…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00523 · Published 2023-08-30 · No fix listed CWE-79
Priority MEDIUM 58
An issue was discovered in Webmin 2.021.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00513 · Published 2023-07-31 · No fix listed CWE-79
Priority MEDIUM 58
An issue was discovered in Webmin 2.021.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00513 · Published 2023-07-31 · No fix listed CWE-79
Priority MEDIUM 60
An issue was discovered in Webmin 2.021.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00649 · Published 2023-07-31 · No fix listed CWE-79
Priority MEDIUM 60
An issue was discovered in Webmin 2.021.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00649 · Published 2023-07-31 · No fix listed CWE-79
Priority MEDIUM 58
An issue was discovered in Webmin 2.021.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00467 · Published 2023-07-31 · No fix listed CWE-79
Priority MEDIUM 60
An issue was discovered in Webmin 2.021.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00599 · Published 2023-07-31 · No fix listed CWE-79
Load more
THREATIST.IORead the docs