Webmin

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Webmin product.

RSS Feeds for Webmin security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Webmin products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Webmin Sorted by Most Security Vulnerabilities since 2018

Webmin53 vulnerabilities

Webmin Usermin15 vulnerabilities

Known Exploited Webmin Vulnerabilities

The following Webmin vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Webmin Command Injection Vulnerability	An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability. CVE-2019-15107 Exploit Probability: 94.5%	March 25, 2022

The vulnerability CVE-2019-15107: Webmin Command Injection Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 0 vulnerabilities in Webmin. Last year, in 2025 Webmin had 3 security vulnerabilities published. Right now, Webmin is on track to have less security vulnerabilities in 2026 than it did last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	3	8.13
2024	8	6.63
2023	27	5.56
2022	14	7.91
2021	3	9.07
2020	4	8.80
2019	6	7.63
2018	1	9.80

It may take a day or so for new Webmin vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Webmin Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-67738	Dec 11, 2025	Unquoted Arg in Webmin Squid cachemgr.cgi (pre2.600) squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).	Webmin
CVE-2025-61541	Oct 16, 2025	Webmin 2.5.10 Host Header Injection in Password Reset Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.	Webmin
CVE-2015-2079	Apr 28, 2025	Usermin <1.660 Remote Code Execution via uconfig_save.cgi (sig_file_free) Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.	Usermin
CVE-2024-12828	Dec 30, 2024	Webmin CGI Command Injection RCE via Authenticated Requests Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of CGI requests. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22346.	Webmin
CVE-2024-44762	Oct 16, 2024	Usermin v2.100 Credential Enumeration via Error Message Discrepancy A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.	Usermin
CVE-2024-45692	Sep 04, 2024	Webmin 2.202 & Virtualmin 7.20.2: Network Traffic Loop via Spoofed UDP 10000 Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.	Webmin
CVE-2024-36452	Jul 10, 2024	CSRF in Webmin ajaxterm (pre-2.003) data leak & server crash Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerability is exploited, unintended operations may be performed when a user views a malicious page while logged in. As a result, data within a system may be referred, a webpage may be altered, or a server may be permanently halted.	Webmin
CVE-2024-36450	Jul 10, 2024	XSS in sysinfo.cgi before v1.910 of Webmin Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a session ID may be obtained, a webpage may be altered, or a server may be halted.	Webmin
CVE-2024-36453	Jul 10, 2024	Webmin/Usermin XSS in session_login.cgi <1.970/1.820 Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a webpage may be altered or sensitive information such as a credential may be disclosed.	Webmin
CVE-2024-36451	Jul 10, 2024	Webmin ajaxterm PrivEsc (2.003) Hijack Console Session Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by an unauthorized user. As a result, data within a system may be referred, a webpage may be altered, or a server may be permanently halted.	Webmin