Vendor
Webmin
24 known vulnerabilities.
Webmin at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 7 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 1 | 1 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 1 | 0 |
| Jun 2026 | 3 | 0 |
| May 2026 | 3 | 1 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 1 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 1 | 1 |
Most common weaknesses
Products
Latest advisories
-
High max 8.1
Webmin multiple vulnerabilities
Webmin contains multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could impersonate and authenticate as any user.
first Jun 18, 2026
24 results · Feed
-
Medium 5.4
Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View
Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containin…
-
High 7.2
Webmin through 2.670 OS Command Injection via Samba User Account Options
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags pa…
-
Medium 4.8CVE-2026-124552 Public exploit
Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgi
Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecm…
-
Medium 6.1
Usermin through 2.570 XSS via mailbox detach.cgi type Parameter
Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment contai…
-
High 8.8
Usermin through 2.570 Path Traversal File Write via detachall.cgi
Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ s…
-
High 7.5
Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an extern…
-
Medium 4.9
Webmin: SSRF exploit in Upload and Download and File Manager modules
Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses b…
-
Critical 9.6
Webmin: Reflected XSS in the Configuration module
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. Thi…
-
Medium 5.3
Webmin 2FA requirement bypass
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requir…
-
High 8.1
Webmin HTTP header authentication bypass
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.
-
Medium 5.3
Webmin information disclosure via regex pattern
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
-
Medium 5.3
Webmin MFA bypass
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.
-
Critical 9.4
Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. Th…
-
Medium 6.1
Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes comp…
-
Medium 5.4
Webmin < 2.641 Stored XSS via System and Server Status
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context o…
-
High 8.5
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module …
-
Critical 9.9
Webmin CGI Command Injection Remote Code Execution Vulnerability
Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability. The specific flaw exists with…
-
Medium 6.1
Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions p…
-
Low 3.1
Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerabi…
-
High 8.8
Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to …
-
Medium 5.4
Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is ex…
-
Medium 5.4
Improper Authorization in webmin/webmin
Improper Authorization in GitHub repository webmin/webmin prior to 1.990.
-
High 8.3
Improper Access Control to Remote Code Execution in webmin/webmin
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.
-
Unscored —
Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbit…