CVE-2022-36446

Description

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Webmin Package Updates RCE
exploit/linux/http/webmin_package_updates_rce

Exploit-DB 1

Webmin 1.996 - Remote Code Execution (RCE) (Authenticated) EDB-50998 · webapps · Aug 1, 2022

GitHub 4 repositories

p0dalirius/CVE-2022-36446-Webmin-Software-Package-Updates-RCE ★ 116 · Aug 11, 2022

A Python script to exploit CVE-2022-36446 Software Package Updates RCE (Authenticated) on Webmin < 1.997.
emirpolatt/CVE-2022-36446 ★ 3 · Sep 9, 2022

CVE-2022-36446 - Webmin 1.996 Remote Code Execution
darnabin/CVE-2022-36446-Webmin-RCE ★ 0 · Jul 4, 2026

Script de python para Webmin 1.996
Kang3639/CVE-2022-36446 ★ 0 · Jun 11, 2024

CVE-2022-36446 POC 실습

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Webmin <1.997 - Authenticated Remote Code Execution http/cves/2022/CVE-2022-36446.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.