Webmin

12 results · Clear filters · Feed

• Medium 5.4
  CVE-2026-125392

  Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View

  Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containin…

  Webmin Webmin
  Nov 9, 2026
• Medium 4.8
  CVE-2026-124552 Public exploit

  Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgi

  Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecm…

  Webmin Webmin
  Nov 8, 2026
• Medium 6.1
  CVE-2026-123622

  Usermin through 2.570 XSS via mailbox detach.cgi type Parameter

  Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment contai…

  Webmin Usermin
  Nov 6, 2026
• Medium 4.9
  CVE-2026-102337

  Webmin: SSRF exploit in Upload and Download and File Manager modules

  Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses b…

  Webmin Webmin
  Nov 4, 2026
• Medium 5.3
  CVE-2026-42210

  Webmin 2FA requirement bypass

  Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requir…

  Webmin Webmin
  Jul 20, 2026
• Medium 5.3
  CVE-2026-56021

  Webmin information disclosure via regex pattern

  Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.

  Webmin Webmin
  Jun 18, 2026
• Medium 5.3
  CVE-2026-56022

  Webmin MFA bypass

  Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.

  Webmin Webmin
  Jun 18, 2026
• Medium 6.1
  CVE-2026-49102

  Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes comp…

  Webmin Webmin
  May 27, 2026
• Medium 5.4
  CVE-2026-22678

  Webmin < 2.641 Stored XSS via System and Server Status

  Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context o…

  Webmin Webmin
  May 21, 2026
• Medium 6.1
  CVE-2024-36453

  Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions p…

  Webmin Webmin Usermin
  Jul 10, 2024
• Medium 5.4
  CVE-2024-36450

  Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is ex…

  Webmin Webmin
  Jul 10, 2024
• Medium 5.4
  CVE-2022-0829

  Improper Authorization in webmin/webmin

  Improper Authorization in GitHub repository webmin/webmin prior to 1.990.

  Webmin webmin/webmin
  Mar 2, 2022