CVE-2026-42210 | | | 2026-07-20 | Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor… |
CVE-2026-56022 | Medium | 5.3 | 2026-06-18 | Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requir… |
CVE-2026-56021 | Medium | 5.3 | 2026-06-18 | Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern. |
CVE-2026-56020 | High | 8.1 | 2026-06-18 | The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP… |
CVE-2026-49103 | | | 2026-05-27 | Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi. |
CVE-2026-49102 | Medium | 6.1 | 2026-05-27 | Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used ins… |
CVE-2026-22678 | Medium | 5.4 | 2026-05-21 | Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that al… |
CVE-2025-67738 | High | 8.5 | 2025-12-11 | squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are availa… |
CVE-2025-61541 | High | 7.1 | 2025-10-16 | Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using… |
CVE-2015-2079 | Critical | 9.9 | 2025-04-28 | Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form o… |
CVE-2024-12828 | High | 8.8 | 2024-12-30 | Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installation… |
CVE-2024-44762 | Medium | 5.3 | 2024-10-16 | A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts. |
CVE-2024-45692 | High | 7.5 | 2024-09-04 | Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000. |
CVE-2024-36453 | Medium | 6.1 | 2024-07-10 | Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If this vulnerability is… |
CVE-2024-36452 | Low | 3.1 | 2024-07-10 | Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerability is exploited, unintended operations… |
CVE-2024-36451 | High | 8.8 | 2024-07-10 | Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploite… |
CVE-2024-36450 | Medium | 5.4 | 2024-07-10 | Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitrary script may be exec… |
CVE-2023-52046 | Medium | 4.8 | 2024-01-25 | Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute… |
CVE-2023-43309 | Medium | 4.8 | 2023-09-21 | There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run ma… |
CVE-2023-41157 | Medium | 5.4 | 2023-09-16 | Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name p… |
CVE-2023-40983 | Medium | 6.1 | 2023-09-15 | A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting… |
CVE-2023-40982 | Medium | 5.4 | 2023-09-15 | A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int… |
CVE-2023-40986 | Medium | 5.4 | 2023-09-15 | A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HT… |
CVE-2023-40985 | Medium | 5.4 | 2023-09-15 | An issue was discovered in Webmin 2.100. The File Manager functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing… |
CVE-2023-40984 | Medium | 5.4 | 2023-09-15 | A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting… |
CVE-2023-41160 | Medium | 5.4 | 2023-09-14 | A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2023-41159 | Medium | 5.4 | 2023-09-14 | A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script… |
CVE-2023-41156 | Medium | 5.4 | 2023-09-14 | A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or… |
CVE-2023-41162 | Medium | 6.1 | 2023-09-13 | A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2023-41158 | Medium | 5.4 | 2023-09-13 | A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2023-41155 | Medium | 5.4 | 2023-09-13 | A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrar… |
CVE-2023-41154 | Medium | 5.4 | 2023-09-13 | A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2023-41152 | Medium | 5.4 | 2023-09-13 | A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2023-41161 | Medium | 5.4 | 2023-09-07 | Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment t… |
CVE-2023-41163 | Medium | 6.1 | 2023-08-30 | A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2023-41153 | Medium | 5.4 | 2023-08-29 | A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2023-38311 | Medium | 5.4 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the System Logs Viewer functionality. The vulnerab… |
CVE-2023-38310 | Medium | 5.4 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs func… |
CVE-2023-38309 | Medium | 6.1 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the package search functionality. The vulnerabi… |
CVE-2023-38308 | Medium | 6.1 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Cross-Site Scripting (XSS) vulnerability was discovered in the HTTP Tunnel functionality when handling third-party d… |
CVE-2023-38307 | Medium | 5.4 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality. The vulnerabil… |
CVE-2023-38306 | Medium | 6.1 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Cross-site Scripting (XSS) Bypass vulnerability was discovered in the file upload functionality. Normally, the appli… |
CVE-2023-38305 | Medium | 6.1 | 2023-07-31 | An issue was discovered in Webmin 2.021. The download functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a cr… |
CVE-2023-38304 | Medium | 5.4 | 2023-07-31 | An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Users and Groups functionality, allowing an at… |
CVE-2023-38303 | Medium | 5.4 | 2023-07-31 | An issue was discovered in Webmin 2.021. One can exploit a stored Cross-Site Scripting (XSS) attack to achieve Remote Command Execution (RCE) through the Users… |
CVE-2022-3844 | Low | 3.5 | 2022-11-02 | A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation… |
CVE-2022-35132 | High | 8.8 | 2022-10-25 | Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module. |
CVE-2022-36880 | Medium | 6.1 | 2022-07-27 | The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message. |
CVE-2022-36446 | Critical | 9.8 | 2022-07-25 | software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. |
CVE-2022-30708 | High | 8.8 | 2022-05-15 | Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or… |
CVE-2021-32162 | High | 8.8 | 2022-04-11 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature. |
CVE-2021-32161 | Medium | 6.1 | 2022-04-11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature. |
CVE-2021-32160 | Medium | 6.1 | 2022-04-11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature. |
CVE-2021-32159 | High | 8.8 | 2022-04-11 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature. |
CVE-2021-32158 | Medium | 6.1 | 2022-04-11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature. |
CVE-2021-32157 | Critical | 9.6 | 2022-04-11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature. |
CVE-2021-32156 | High | 8.8 | 2022-04-11 | A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature. |
CVE-2022-0829 | High | 8.1 | 2022-03-02 | Improper Authorization in GitHub repository webmin/webmin prior to 1.990. |
CVE-2022-0824 | High | 8.8 | 2022-03-02 | Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. |
CVE-2021-31762 | High | 8.8 | 2021-04-25 | Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell thro… |
CVE-2021-31761 | Critical | 9.6 | 2021-04-25 | Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature. |
CVE-2021-31760 | High | 8.8 | 2021-04-25 | Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature. |
CVE-2020-35769 | Critical | 9.8 | 2020-12-29 | miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program. |
CVE-2020-35606 | High | 8.8 | 2020-12-21 | Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root priv… |
CVE-2020-8821 | Medium | 5.4 | 2020-10-12 | An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML code into the Command… |
CVE-2020-8820 | Medium | 5.4 | 2020-10-12 | An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field… |
CVE-2020-12670 | Medium | 6.1 | 2020-10-12 | XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This… |
CVE-2019-15642 | High | 8.8 | 2019-08-26 | rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the… |
CVE-2019-15641 | Medium | 6.5 | 2019-08-26 | xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi. |
CVE-2019-15107 | Critical | 9.8 | 2019-08-16 | An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability. |
CVE-2019-12840 | High | 8.8 | 2019-06-15 | In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to upda… |
CVE-2018-19191 | Medium | 5.4 | 2019-03-21 | Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall par… |
CVE-2019-9624 | High | 7.8 | 2019-03-07 | Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted… |
CVE-2018-8712 | Critical | 9.8 | 2018-03-14 | An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default con… |
CVE-2017-17089 | Medium | 4.8 | 2017-12-30 | custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functio… |
CVE-2017-15646 | Medium | 6.1 | 2017-10-19 | Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to downloa… |
CVE-2017-15645 | High | 8.8 | 2017-10-19 | CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands. |
CVE-2017-15644 | High | 8.6 | 2017-10-19 | SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000. |
CVE-2017-9313 | Medium | 6.1 | 2017-07-04 | Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter… |
CVE-2017-2106 | Medium | 6.1 | 2017-04-28 | Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HTML via unspecified… |
CVE-2016-4897 | Medium | 6.1 | 2017-04-12 | Multiple cross-site scripting (XSS) vulnerabilities in (1) filter/save_forward.cgi, (2) filter/save.cgi, (3) /man/search.cgi in Usermin before 1.690. |
CVE-2015-1377 | | | 2015-02-10 | The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file. |
CVE-2014-3886 | | | 2014-07-20 | Cross-site scripting (XSS) vulnerability in Webmin before 1.690, when referrer checking is disabled, allows remote attackers to inject arbitrary web script or… |
CVE-2014-3885 | | | 2014-07-20 | Cross-site scripting (XSS) vulnerability in Webmin before 1.690 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vector… |
CVE-2014-3884 | | | 2014-07-20 | Cross-site scripting (XSS) vulnerability in Usermin before 1.600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE… |
CVE-2014-3883 | | | 2014-06-21 | Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action. |
CVE-2014-3924 | | | 2014-05-30 | Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HT… |
CVE-2014-0339 | | | 2014-03-16 | Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search param… |
CVE-2011-1937 | | | 2011-05-31 | Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes… |
CVE-2009-4568 | | | 2010-01-05 | Cross-site scripting (XSS) vulnerability in Webmin before 1.500 and Usermin before 1.430 allows remote attackers to inject arbitrary web script or HTML via uns… |
CVE-2008-0720 | | | 2008-02-12 | Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2007-5066 | | | 2007-09-24 | Unspecified vulnerability in Webmin before 1.370 on Windows allows remote authenticated users to execute arbitrary commands via a crafted URL. |
CVE-2007-3156 | | | 2007-06-11 | Multiple cross-site scripting (XSS) vulnerabilities in pam_login.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers to inject arbitrary… |
CVE-2007-1276 | | | 2007-03-05 | Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary w… |
CVE-2006-4542 | | | 2006-09-05 | Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site sc… |
CVE-2006-3392 | | | 2006-07-06 | Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as d… |
CVE-2006-3274 | | | 2006-06-28 | Directory traversal vulnerability in Webmin before 1.280, when run on Windows, allows remote attackers to read arbitrary files via \ (backslash) characters in… |
CVE-2005-3912 | | | 2005-11-30 | Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attacker… |
CVE-2005-3042 | | | 2005-09-22 | miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoo… |
CVE-2005-1177 | | | 2005-05-02 | Unknown vulnerability in (1) Webmin and (2) Usermin before 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact. |