Webmin Command Injection Vulnerability

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command

miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program

An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled

Webmin: Reflected XSS in the Configuration module

A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature

Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component

Webmin CGI Command Injection Remote Code Execution Vulnerability

Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003

Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin)

A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature

A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature

A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature

Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990

Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running…

Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature

Arbitrary command execution can occur in Webmin through 1.962

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi

CSRF exists in Webmin 1.850

SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000

squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments

Webmin HTTP header authentication bypass

Improper Authorization in GitHub repository webmin/webmin prior to 1.990

Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the…

Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi)

xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks

Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe type…

Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820

A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload…

A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in…

An issue was discovered in Webmin 2.021

An issue was discovered in Webmin 2.021

An issue was discovered in Webmin 2.021

An issue was discovered in Webmin 2.021

Webmin index.cgi cross site scripting

The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message

A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature

A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature

A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature

XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails

Webmin before 1.860 has XSS with resultant remote code execution

Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the…

Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors

Webmin < 2.641 Stored XSS via System and Server Status

Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910

A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module…

A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted…