Webmin

Products

Exploited and recent CVEs

• CVE-2026-102337 Medium 4.9 Webmin: SSRF exploit in Upload and Download and File Manager modules 0.5%
• CVE-2026-49243 Critical 9.6 Webmin: Reflected XSS in the Configuration module 0.3%
• CVE-2026-42210 Medium 5.3 Webmin 2FA requirement bypass 0.5%
• CVE-2026-56020 High 8.1 Webmin HTTP header authentication bypass 0.5%
• CVE-2026-56021 Medium 5.3 Webmin information disclosure via regex pattern 0.5%
• CVE-2026-56022 Medium 5.3 Webmin MFA bypass 0.6%
• CVE-2026-49103 Critical 9.4 Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi. 0.4%
• CVE-2026-49102 Medium 6.1 Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe type (e.g., text/plain). 0.2%
• CVE-2026-22678 Medium 5.4 Webmin < 2.641 Stored XSS via System and Server Status 0.2%
• CVE-2025-67738 High 8.5 squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to au 0.4%
• CVE-2024-12828 Critical 9.9 Webmin CGI Command Injection Remote Code Execution Vulnerability 33.3%
• CVE-2024-36453 Medium 6.1 Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If this vulnerability is exploited, an arbitrary script may be exe 0.4%
• CVE-2024-36453 Medium 6.1 Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If this vulnerability is exploited, an arbitrary script may be exe 0.4%
• CVE-2024-36452 Low 3.1 Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. If this vulnerability is exploited, unintended operations may be performed when a user views a mal 0.2%
• CVE-2024-36451 High 8.8 Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by a 0.6%
• CVE-2024-36450 Medium 5.4 Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who a 0.3%
• CVE-2022-0829 Medium 5.4 Improper Authorization in webmin/webmin 1.3%
• CVE-2022-0824 High 8.3 Improper Access Control to Remote Code Execution in webmin/webmin 97.0%