CveMateVulnerability intelligence

Webmin vulnerabilities, page 3

118 vulnerabilities

Known vulnerabilities in Webmin products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.

CVE-2022-0829webminwebmin+14y ago02-03-2022 12:10

Improper Authorization in GitHub repository webmin/webmin prior to 1.990.CVE-2022-0824webminwebmin+14y ago02-03-2022 00:00

Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.CVE-2022-36446webminwebmin4y ago25-07-2022 05:56

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.CVE-2022-36880webminusermin+14y ago27-07-2022 03:32

The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message.CVE-2022-30708mageiawebmin+14y ago15-05-2022 02:30

Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.CVE-2022-3844webminwebmin3y ago02-11-2022 00:00

A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.003 is able to address this issue. The patch is identified as d3d33af3c0c3fd3a889c84e287a038b7a457d811. It is recommended to upgrade the affected component. VDB-212862 is the identifier assigned to this vulnerability.CVE-2022-35132webminusermin3y ago25-10-2022 00:00

Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.CVE-2011-1937webminwebmin15y ago31-05-2011 20:00

Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real (aka Full Name) field, related to useradmin/index.cgi and useradmin/user-lib.pl.CVE-2017-2106webminwebmin9y ago28-04-2017 16:00

Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2017-9313webminwebmin9y ago04-07-2017 02:00

Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.CVE-2017-17089webminwebmin8y ago30-12-2017 17:00

custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality.CVE-2017-15645webminwebmin9y ago19-10-2017 22:00

CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands.CVE-2017-15646webminwebmin9y ago19-10-2017 22:00

Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload that will lead to Remote Code Execution, as demonstrated by an OS command in the value attribute of a name='cmd' input element.CVE-2017-15644webminwebmin9y ago19-10-2017 22:00

SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000.CVE-1999-1074webminwebmin24y ago09-03-2002 05:00

Webmin before 0.5 does not restrict the number of invalid passwords that are entered for a valid username, which could allow remote attackers to gain privileges via brute force password cracking.CVE-2004-1468userminusermin+121y ago13-02-2005 05:00

The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message.CVE-2004-0582webminwebmin22y ago23-06-2004 04:00

Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module.CVE-2004-0559debianwebmin+422y ago24-09-2004 04:00

The maketemp.pl script in Usermin 1.070 and 1.080 allows local users to overwrite arbitrary files at install time via a symlink attack on the /tmp/.usermin directory.CVE-2004-0583debiandebian_linux+222y ago23-06-2004 04:00

The account lockout functionality in (1) Webmin 1.140 and (2) Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords.CVE-2024-36453webminusermin+12y ago10-07-2024 07:02

Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a webpage may be altered or sensitive information such as a credential may be disclosed.