CVE-2004-0582: webmin

EPSS trend

Probability

2.08%

Chance of exploitation in the next 30 days

Percentile

81%

Versus all other CVEs

30-day change

0.00 pp

From 2.08% on 20-09-2026

20-09-202620-10-2026

EPSS score

2.08%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

10 links

www.securityfocus.com/bid/10474VDB EntryX Refsource BIDPatchVendor Advisory
www.debian.org/security/2004/dsa-526Vendor AdvisoryX Refsource DEBIAN
marc.info?l=bugtraq&m=108697184602191&w=2Mailing ListX Refsource BUGTRAQ
www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:074Vendor AdvisoryX Refsource MANDRAKE
distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000848Vendor AdvisoryX Refsource CONECTIVA
exchange.xforce.ibmcloud.com/vulnerabilities/16333VDB EntryX Refsource XF
www.webmin.com/changes-1.150.htmlX Refsource CONFIRM
www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/74_e.htmlX Refsource MISC
www.gentoo.org/security/en/glsa/glsa-200406-12.xmlVendor AdvisoryX Refsource GENTOO
www.securityfocus.com/bid/10522VDB EntryX Refsource BIDPatchVendor Advisory

Related vulnerabilities

CVE-2018-19191webminwebmin39.07%7y ago17-03-2019 21:27Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall parameter.CVE-2018-8712webminwebmin1.79%8y ago14-03-2018 19:00An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data from the local system (using Local File Include) such as the '/etc/shadow' file via a "GET /syslog/save_log.cgi?view=1&file=/etc/shadow" request.CVE-2025-61541webminwebmin0.46%1y ago16-10-2025 00:00Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.CVE-2025-67738webminwebmin0.36%10mo ago11-12-2025 06:34squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).CVE-2020-35606webminwebmin28.05%5y ago21-12-2020 19:19Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.CVE-2008-0720webminusermin+11.22%18y ago12-02-2008 01:00Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary web script or HTML via the search parameter to webmin_search.cgi (aka the search section), and possibly other components accessed through a "search box" or "open file box." NOTE: some of these details are obtained from third party information.

All vulnerabilities inwebmin

CVE-2004-0582: webmin

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References