CVE-2019-12840

Description

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Webmin Package Updates Remote Command Execution
exploit/linux/http/webmin_packageup_rce

Exploit-DB 1

Webmin 1.910 - 'Package Updates' Remote Command Execution (Metasploit) EDB-46984 · remote · Jun 11, 2019 · verified

GitHub 7 repositories

KrE80r/webmin_cve-2019-12840_poc ★ 8 · Nov 9, 2019

A standalone POC for CVE-2019-12840
bkaraceylan/CVE-2019-12840_POC ★ 4 · Nov 5, 2019

PoC for Webmin Package Update Authenticated Remote Command Execution
note0577/CVE-2019-12840-NodeJs-Exploit ★ 0 · Jun 4, 2025

Authenticated Remote Command Execution - Webmin <= 1.910
Pol-Ruiz/PoC-CVE-2019-12840 ★ 0 · Jan 25, 2024

Esto es una prueba de concepto propia i basica de la vulneravilidad CVE-2019-12840 la qual te da un RCE en root
WizzzStark/CVE-2019-12840.py ★ 0 · Oct 5, 2021

POC: CVE-2019-12840 (Authenticated RCE - Webmin Package Updates)
zAbuQasem/CVE-2019-12840 ★ 0 · Mar 30, 2021

CVE-2019-12840
anasbousselham/webminscan ★ 0 · Dec 23, 2020

Webmin Exploit Scanner CVE-2020-35606 CVE-2019-12840

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the da…