CVE-2019-12840: webmin OS Command Injection

EPSS trend

Probability

77.50%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.34 pp

From 77.83% on 20-09-2026

20-09-202620-10-2026

EPSS score

77.50%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (pentest.com.tr)
Maturity: unknown
exploit-databaseremotelinuxVerified
Webmin 1.910 - 'Package Updates' Remote Command Execution (Metasploit)
Maturity: weaponized
MetasploitremoteVerified
Webmin Package Updates Remote Command Execution
exploit/linux/http/webmin_packageup_rce
Maturity: weaponized

References

4 links

www.exploit-db.com/exploits/46984X Refsource MISCExploitThird Party AdvisoryVDB Entry
pentest.com.tr/exploits/Webmin-1910-Package-Updates-Remote-Command-Execution.htmlX Refsource MISCExploitThird Party Advisory
www.securityfocus.com/bid/108790VDB EntryX Refsource BID
packetstormsecurity.com/files/153372/Webmin-1.910-Remote-Command-Execution.htmlX Refsource MISC

Related vulnerabilities

CVE-2018-19191webminwebmin39.07%7y ago17-03-2019 21:27Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall parameter.CVE-2018-8712webminwebmin1.79%8y ago14-03-2018 19:00An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data from the local system (using Local File Include) such as the '/etc/shadow' file via a "GET /syslog/save_log.cgi?view=1&file=/etc/shadow" request.CVE-2025-61541webminwebmin0.46%1y ago16-10-2025 00:00Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.CVE-2025-67738webminwebmin0.36%10mo ago11-12-2025 06:34squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).CVE-2020-35606webminwebmin28.05%5y ago21-12-2020 19:19Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.CVE-2008-0720webminusermin+11.22%18y ago12-02-2008 01:00Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary web script or HTML via the search parameter to webmin_search.cgi (aka the search section), and possibly other components accessed through a "search box" or "open file box." NOTE: some of these details are obtained from third party information.

All vulnerabilities inwebmin

CVE-2019-12840: webmin OS Command Injection

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References