CVE-2006-3392: usermin

EPSS trend

Probability

79.49%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+1.20 pp

From 78.29% on 20-09-2026

20-09-202620-10-2026

EPSS score

79.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

exploit-databaseremotemultipleVerified
Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure
Maturity: weaponized
exploit-databaseremotemultipleVerified
Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure
Maturity: weaponized
MetasploitremoteUnverified
Webmin File Disclosure
auxiliary/admin/webmin/file_disclosure
Maturity: poc

References

18 links

secunia.com/advisories/21365Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
security.gentoo.org/glsa/glsa-200608-11.xmlVendor AdvisoryX Refsource GENTOO
www.webmin.com/changes.htmlX Refsource CONFIRM
www.securityfocus.com/archive/1/440125/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/21105Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/bid/18744VDB EntryX Refsource BID
www.securityfocus.com/archive/1/440493/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/archive/1/440466/100/0/threadedMailing ListX Refsource BUGTRAQ
www.kb.cert.org/vuls/id/999601Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.debian.org/security/2006/dsa-1199Vendor AdvisoryX Refsource DEBIAN

Show all 18 references

attrition.org/pipermail/vim/2006-June/000912.htmlMailing ListX Refsource VIM
secunia.com/advisories/20892Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.mandriva.com/security/advisories?name=MDKSA-2006:125Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2006/2612VDB EntryX Refsource VUPENVendor Advisory
www.securityfocus.com/archive/1/439653/100/0/threadedMailing ListX Refsource BUGTRAQ
www.osvdb.org/26772VDB EntryX Refsource OSVDBPatch
secunia.com/advisories/22556Third Party AdvisoryX Refsource SECUNIAVendor Advisory
attrition.org/pipermail/vim/2006-July/000923.htmlMailing ListX Refsource VIM

Related vulnerabilities

CVE-2018-19191webminwebmin39.07%7y ago17-03-2019 21:27Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall parameter.CVE-2018-8712webminwebmin1.79%8y ago14-03-2018 19:00An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data from the local system (using Local File Include) such as the '/etc/shadow' file via a "GET /syslog/save_log.cgi?view=1&file=/etc/shadow" request.CVE-2003-0101debianwebmin+315.47%23y ago26-02-2003 05:00miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges.CVE-2015-2079userminusermin+11.54%1y ago28-04-2025 00:00Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.CVE-2007-1276userminusermin+10.63%19y ago05-03-2007 20:00Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename.CVE-2025-61541webminwebmin0.46%1y ago16-10-2025 00:00Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.

All vulnerabilities inusermin webmin

CVE-2006-3392: usermin

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References