CveMateVulnerability intelligence

Webmin vulnerabilities

118 vulnerabilities

Known vulnerabilities in Webmin products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.

Products

4

Webmin102 vulnerabilities
Usermin22 vulnerabilities
Webmin/Webmin2 vulnerabilities
Userwin1 vulnerabilities

CVE-2018-19191webminwebmin7y ago17-03-2019 21:27

Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall parameter.CVE-2018-8712webminwebmin8y ago14-03-2018 19:00

An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data from the local system (using Local File Include) such as the '/etc/shadow' file via a "GET /syslog/save_log.cgi?view=1&file=/etc/shadow" request.CVE-2003-0101debianwebmin+323y ago26-02-2003 05:00

miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges.CVE-2021-31762webminwebmin5y ago25-04-2021 18:32

Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running process feature.CVE-2021-31761webminwebmin5y ago25-04-2021 18:30

Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.CVE-2021-31760webminwebmin5y ago25-04-2021 18:28

Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature.CVE-2021-32161webminwebmin4y ago11-04-2022 05:45

A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.CVE-2021-32162webminwebmin4y ago11-04-2022 05:46

A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.CVE-2021-32158webminwebmin4y ago11-04-2022 05:40

A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.CVE-2021-32159webminwebmin4y ago11-04-2022 05:41

A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.CVE-2021-32157webminwebmin4y ago11-04-2022 05:38

A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.CVE-2021-32156webminwebmin4y ago11-04-2022 05:37

A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.CVE-2021-32160webminwebmin4y ago11-04-2022 05:43

A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.CVE-2015-2079userminusermin+11y ago28-04-2025 00:00

Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.CVE-2015-1377webminwebmin11y ago10-02-2015 20:00

The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.CVE-2007-1276userminusermin+119y ago05-03-2007 20:00

Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename.CVE-2007-5066webminwebmin19y ago24-09-2007 23:00

Unspecified vulnerability in Webmin before 1.370 on Windows allows remote authenticated users to execute arbitrary commands via a crafted URL.CVE-2007-3156webminusermin+119y ago11-06-2007 22:00

Multiple cross-site scripting (XSS) vulnerabilities in pam_login.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) message, or (3) question parameter. NOTE: some of these details are obtained from third party information.CVE-2016-4897webminusermin9y ago12-04-2017 22:00

Multiple cross-site scripting (XSS) vulnerabilities in (1) filter/save_forward.cgi, (2) filter/save.cgi, (3) /man/search.cgi in Usermin before 1.690.CVE-2025-61541webminwebmin1y ago16-10-2025 00:00

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.