WE
Product
webmin
On CISA KEVExploited in the wildRansomware-linked
102
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 8High 20Medium 39Low 1
Watch
Add webmin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-12828 | 8.8 | Dec 30 | Webmin CGI Command Injection Remote Code Execution Vulnerability Affected: webmin 2.104 |
| CVE-2024-36451 | 8.8 | Jul 10 | Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003 Affected: before 2.003 |
| CVE-2022-30708 | 8.8 | May 15 | Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin) Affected: through 1.991 |
| CVE-2021-32162 | 8.8 | Apr 11 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature Affected: 1.973 |
| CVE-2021-32159 | 8.8 | Apr 11 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature Affected: 1.973 |
| CVE-2021-32156 | 8.8 | Apr 11 | A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature Affected: 1.973 |
| CVE-2022-0824 | 8.8 | Mar 2 | Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990 Affected: before 1.990 |
| CVE-2021-31762 | 8.8 | Apr 25 | Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running… Affected: 1.973 |
| CVE-2021-31760 | 8.8 | Apr 25 | Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature Affected: 1.973 |
| CVE-2020-35606 | 8.8 | Dec 21 | Arbitrary command execution can occur in Webmin through 1.962 Affected: through 1.962 |
| CVE-2019-15642 | 8.8 | Aug 26 | rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call Affected: through 1.920 |
| CVE-2019-12840 | 8.8 | Jun 15 | In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi Affected: through 1.910 |
| CVE-2017-15645 | 8.8 | Oct 19 | CSRF exists in Webmin 1.850 Affected: through 1.850 |
| CVE-2017-15644 | 8.6 | Oct 19 | SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000 Affected: through 1.850 |
| CVE-2025-67738 | 8.5 | Dec 11 | squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments Affected: before 2.600 |
| CVE-2026-56020 | 8.1 | Jun 18 | Webmin HTTP header authentication bypass Affected: before 2.202 |
| CVE-2022-0829 | 8.1 | Mar 2 | Improper Authorization in GitHub repository webmin/webmin prior to 1.990 Affected: before 1.990 |
| CVE-2019-9624 | 7.8 | Mar 7 | Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the… Affected: 1.900 |
| CVE-2024-45692 | 7.5 | Sep 4 | Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000 Affected: before 2.202 |
| CVE-2025-61541 | 7.1 | Oct 16 | Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi) Affected: 2.510 |
Showing 20