WE
Product
webmin
On CISA KEVExploited in the wildRansomware-linked
101
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 8High 19Medium 39Low 1
Watch
Add webmin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-15107 RansomwareIn wildKEV | 9.8 | Aug 16 | Webmin Command Injection Vulnerability Affected: through 1.920 |
| CVE-2022-36446 | 9.8 | Jul 25 | software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command Affected: before 1.997 |
| CVE-2020-35769 | 9.8 | Dec 29 | miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program Affected: 1.962 |
| CVE-2018-8712 | 9.8 | Mar 14 | An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled Affected: 1.840; 1.880 |
| CVE-2026-49243 | 9.6 | Sep 29 | Webmin: Reflected XSS in the Configuration module Affected: < 2.650 |
| CVE-2021-32157 | 9.6 | Apr 11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature Affected: 1.973 |
| CVE-2021-31761 | 9.6 | Apr 25 | Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature Affected: 1.973 |
| CVE-2026-49103 | 9.4 | May 27 | Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component Affected: before 2.640 |
Showing 8