WE
Product
webmin
On CISA KEVExploited in the wildRansomware-linked
102
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 8High 20Medium 39Low 1
Watch
Add webmin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-15641 | 6.5 | Aug 26 | xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks Affected: through 1.930 |
| CVE-2026-49102 | 6.1 | May 27 | Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe type… Affected: before 2.640 |
| CVE-2024-36453 | 6.1 | Jul 10 | Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820 Affected: before 1.970 |
| CVE-2023-40983 | 6.1 | Sep 15 | A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload… Affected: 2.100 |
| CVE-2023-41163 | 6.1 | Aug 30 | A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in… Affected: 2.000 |
| CVE-2023-38309 | 6.1 | Jul 31 | An issue was discovered in Webmin 2.021 Affected: 2.021 |
| CVE-2023-38308 | 6.1 | Jul 31 | An issue was discovered in Webmin 2.021 Affected: 2.021 |
| CVE-2023-38306 | 6.1 | Jul 31 | An issue was discovered in Webmin 2.021 Affected: 2.021 |
| CVE-2023-38305 | 6.1 | Jul 31 | An issue was discovered in Webmin 2.021 Affected: 2.021 |
| CVE-2022-3844 | 6.1 | Nov 2 | Webmin index.cgi cross site scripting Affected: 2.001 |
| CVE-2022-36880 | 6.1 | Jul 27 | The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message Affected: 1.995 |
| CVE-2021-32161 | 6.1 | Apr 11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature Affected: 1.973 |
| CVE-2021-32160 | 6.1 | Apr 11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature Affected: 1.973 |
| CVE-2021-32158 | 6.1 | Apr 11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature Affected: 1.973 |
| CVE-2020-12670 | 6.1 | Oct 12 | XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails Affected: through 1.941 |
| CVE-2017-15646 | 6.1 | Oct 19 | Webmin before 1.860 has XSS with resultant remote code execution Affected: through 1.850 |
| CVE-2017-9313 | 6.1 | Jul 4 | Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the… Affected: through 1.840 |
| CVE-2017-2106 | 6.1 | Apr 28 | Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 1.820 |
| CVE-2026-22678 | 5.4 | May 21 | Webmin < 2.641 Stored XSS via System and Server Status Affected: before 2.641 |
| CVE-2024-36450 | 5.4 | Jul 10 | Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910 Affected: before 1.910 |
| CVE-2023-40982 | 5.4 | Sep 15 | A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module… Affected: 2.100 |
| CVE-2023-40986 | 5.4 | Sep 15 | A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted… Affected: 2.100 |
| CVE-2023-40985 | 5.4 | Sep 15 | An issue was discovered in Webmin 2.100 Affected: 2.100 |
| CVE-2023-40984 | 5.4 | Sep 15 | A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload… Affected: 2.100 |
| CVE-2023-41155 | 5.4 | Sep 13 | A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML… Affected: 2.000 |
| CVE-2023-38311 | 5.4 | Jul 31 | An issue was discovered in Webmin 2.021 Affected: 2.021 |
| CVE-2023-38310 | 5.4 | Jul 31 | An issue was discovered in Webmin 2.021 Affected: 2.021 |
| CVE-2023-38307 | 5.4 | Jul 31 | An issue was discovered in Webmin 2.021 Affected: 2.021 |
| CVE-2023-38304 | 5.4 | Jul 31 | An issue was discovered in Webmin 2.021 Affected: 2.021 |
| CVE-2023-38303 | 5.4 | Jul 31 | An issue was discovered in Webmin 2.021 Affected: 2.021 |
| CVE-2020-8821 | 5.4 | Oct 12 | An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint Affected: through 1.941 |
| CVE-2020-8820 | 5.4 | Oct 12 | An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint Affected: through 1.941 |
| CVE-2018-19191 | 5.4 | Mar 17 | Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall parameter Affected: 1.890 |
| CVE-2026-42210 | 5.3 | Jul 20 | Webmin 2FA requirement bypass Affected: < 2.640 |
| CVE-2026-56021 | 5.3 | Jun 18 | Webmin information disclosure via regex pattern Affected: before 1.290 |
| CVE-2026-56022 | 5.3 | Jun 18 | Webmin MFA bypass Affected: before 2.640 |
| CVE-2023-52046 | 4.8 | Jan 25 | Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute cron job as" tab… Affected: through 2.105 |
| CVE-2023-43309 | 4.8 | Sep 21 | There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by… Affected: through 2.002 |
| CVE-2017-17089 | 4.8 | Dec 30 | custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality Affected: through 1.860 |
Showing 39