Webmin

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Webmin product.

RSS Feeds for Webmin security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Webmin products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Webmin Sorted by Most Security Vulnerabilities since 2018

Webmin56 vulnerabilities

Webmin Usermin15 vulnerabilities

Known Exploited Webmin Vulnerabilities

The following Webmin vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Webmin Command Injection Vulnerability	An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability. CVE-2019-15107 Exploit Probability: 94.5%	March 25, 2022

The vulnerability CVE-2019-15107: Webmin Command Injection Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 3 vulnerabilities in Webmin with an average score of 5.8 out of ten. Last year, in 2025 Webmin had 3 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Webmin in 2026 could surpass last years number. Last year, the average CVE base score was greater by 2.38

Year	Vulnerabilities	Average Score
2026	3	5.75
2025	3	8.13
2024	8	6.63
2023	27	5.56
2022	14	7.91
2021	3	9.07
2020	4	8.80
2019	6	7.63
2018	1	9.80

It may take a day or so for new Webmin vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Webmin Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-49103	May 27, 2026	Webmin < 2.640 - insecure filename construction in mailboxes/detachall.cgi Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.	Webmin
CVE-2026-49102	May 27, 2026	Webmin XSS via SVG attachment in mailboxes (before 2.640) Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe type (e.g., text/plain).	Webmin
CVE-2026-22678	May 21, 2026	Webmin <2.641 Stored XSS in Email Template Description (System & Server Status) Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.	Webmin
CVE-2025-67738	Dec 11, 2025	Unquoted Arg in Webmin Squid cachemgr.cgi (pre2.600) squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).	Webmin
CVE-2025-61541	Oct 16, 2025	Webmin 2.5.10 Host Header Injection in Password Reset Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.	Webmin
CVE-2015-2079	Apr 28, 2025	Usermin <1.660 Remote Code Execution via uconfig_save.cgi (sig_file_free) Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.	Usermin
CVE-2024-12828	Dec 30, 2024	Webmin CGI Command Injection RCE via Authenticated Requests Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of CGI requests. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22346.	Webmin
CVE-2024-44762	Oct 16, 2024	Usermin v2.100 Credential Enumeration via Error Message Discrepancy A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.	Usermin
CVE-2024-45692	Sep 04, 2024	Webmin 2.202 & Virtualmin 7.20.2: Network Traffic Loop via Spoofed UDP 10000 Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.	Webmin
CVE-2024-36450	Jul 10, 2024	XSS in sysinfo.cgi before v1.910 of Webmin Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a session ID may be obtained, a webpage may be altered, or a server may be halted.	Webmin