CVE-2019-9624: webmin Improper Privilege Management

EPSS trend

Probability

23.69%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 23.69% on 20-09-2026

20-09-202620-10-2026

EPSS score

23.69%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (pentest.com.tr)
Maturity: unknown
exploit-databaseremotecgiUnverified
Webmin 1.900 - Remote Command Execution (Metasploit)
Maturity: poc
MetasploitremoteVerified
Webmin Upload Authenticated RCE
exploit/unix/webapp/webmin_upload_exec
Maturity: weaponized

References

3 links

www.exploit-db.com/exploits/46201ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
pentest.com.tr/exploits/Webmin-1900-Remote-Command-Execution.htmlX Refsource MISCExploitThird Party Advisory
www.rapid7.com/db/modules/exploit/unix/webapp/webmin_upload_execX Refsource MISCThird Party Advisory

Related vulnerabilities

CVE-2018-19191webminwebmin39.07%7y ago17-03-2019 21:27Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall parameter.CVE-2018-8712webminwebmin1.79%8y ago14-03-2018 19:00An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data from the local system (using Local File Include) such as the '/etc/shadow' file via a "GET /syslog/save_log.cgi?view=1&file=/etc/shadow" request.CVE-2025-61541webminwebmin0.46%1y ago16-10-2025 00:00Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.CVE-2025-67738webminwebmin0.36%10mo ago11-12-2025 06:34squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).CVE-2020-35606webminwebmin28.05%5y ago21-12-2020 19:19Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.CVE-2008-0720webminusermin+11.22%18y ago12-02-2008 01:00Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary web script or HTML via the search parameter to webmin_search.cgi (aka the search section), and possibly other components accessed through a "search box" or "open file box." NOTE: some of these details are obtained from third party information.

All vulnerabilities inwebmin

CVE-2019-9624: webmin Improper Privilege Management

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References