CveMateVulnerability intelligence

Webmin vulnerabilities, page 2

118 vulnerabilities

Known vulnerabilities in Webmin products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.

CVE-2025-67738webminwebmin10mo ago11-12-2025 06:34

squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).CVE-2020-12670webminwebmin6y ago12-10-2020 15:56

XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This module parses any output without sanitizing SCRIPT elements, as opposed to the View function, which sanitizes the input correctly. A malicious user can send any JavaScript payload into the message body and execute it if the user decides to save that email.CVE-2020-8821webminwebmin6y ago12-10-2020 15:54

An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML code into the Command field and submit it. Then, after visiting the Action Logs Menu and displaying logs, the HTML code will be rendered (however, JavaScript is not executed). Changes are kept across users.CVE-2020-8820webminwebmin6y ago12-10-2020 15:52

An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field and execute it. Then, after revisiting the Cluster Shell Commands Menu, the XSS Payload will be rendered and executed.CVE-2020-35606webminwebmin5y ago21-12-2020 19:19

Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.CVE-2020-35769webminwebmin5y ago29-12-2020 05:35

miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.CVE-2014-0339webminwebmin12y ago16-03-2014 10:00

Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter.CVE-2014-3886webminwebmin12y ago20-07-2014 10:00

Cross-site scripting (XSS) vulnerability in Webmin before 1.690, when referrer checking is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.CVE-2014-3885webminwebmin12y ago20-07-2014 10:00

Cross-site scripting (XSS) vulnerability in Webmin before 1.690 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.CVE-2014-3924webminuserwin+112y ago30-05-2014 14:00

Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HTML via vectors related to popup windows.CVE-2014-3883webminusermin12y ago21-06-2014 15:00

Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action.CVE-2014-3884webminusermin12y ago20-07-2014 10:00

Cross-site scripting (XSS) vulnerability in Usermin before 1.600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.CVE-2001-1530webminwebmin21y ago14-07-2005 04:00

run.cgi in Webmin 0.80 and 0.88 creates temporary files with world-writable permissions, which allows local users to execute arbitrary commands.CVE-2001-1196webminwebmin24y ago15-03-2002 05:00

Directory traversal vulnerability in edit_action.cgi of Webmin Directory 0.91 allows attackers to gain privileges via a '..' (dot dot) in the argument.CVE-2001-1074webminwebmin24y ago25-06-2002 04:00

Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.CVE-2001-0222webminwebmin25y ago07-05-2001 04:00

webmin 0.84 and earlier allows local users to overwrite and create arbitrary files via a symlink attack.CVE-2005-1177userminusermin+121y ago19-04-2005 04:00

Unknown vulnerability in (1) Webmin and (2) Usermin before 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.CVE-2005-3912debiandebian_linux+120y ago30-11-2005 11:00

Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service (crash or memory consumption) and possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is ultimately used in a syslog call. NOTE: the code execution might be associated with an issue in Perl.CVE-2005-3042userminusermin+121y ago22-09-2005 04:00

miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return).CVE-2008-0720webminusermin+118y ago12-02-2008 01:00

Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary web script or HTML via the search parameter to webmin_search.cgi (aka the search section), and possibly other components accessed through a "search box" or "open file box." NOTE: some of these details are obtained from third party information.