Vulnerabilities in Webmin
22 resultsCVE-2022-0824HIGHImproper Access Control to Remote Code Execution in webmin/webminEPSS 97.0%CVE-2024-12828CRITICALWebmin CGI Command Injection Remote Code Execution VulnerabilityEPSS 33.3%CVE-2017-2106—Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HTEPSS 1.7%CVE-2026-123620HIGHUsermin through 2.570 OS Command Injection via Read Mail IMAP Folder DeletionEPSS 1.4%CVE-2022-0829MEDIUMImproper Authorization in webmin/webminEPSS 1.3%CVE-2026-123621HIGHUsermin through 2.570 Path Traversal File Write via detachall.cgiEPSS 1.0%CVE-2024-36451HIGHImproper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerEPSS 0.6%CVE-2026-56022MEDIUMWebmin MFA bypassEPSS 0.6%CVE-2026-42210MEDIUMWebmin 2FA requirement bypassEPSS 0.5%CVE-2026-102337MEDIUMWebmin: SSRF exploit in Upload and Download and File Manager modulesEPSS 0.5%CVE-2026-56020CRITICALWebmin HTTP header authentication bypassEPSS 0.5%CVE-2026-56021MEDIUMWebmin information disclosure via regex patternEPSS 0.5%CVE-2024-36453MEDIUMCross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If thiEPSS 0.4%CVE-2026-49103CRITICALWebmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxeEPSS 0.4%CVE-2025-67738HIGHsquid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache ManagerEPSS 0.4%CVE-2024-36450MEDIUMCross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitraryEPSS 0.3%CVE-2026-49243CRITICALWebmin: Reflected XSS in the Configuration moduleEPSS 0.3%CVE-2026-123622MEDIUMUsermin through 2.570 XSS via mailbox detach.cgi type ParameterEPSS 0.3%CVE-2026-22678MEDIUMWebmin < 2.641 Stored XSS via System and Server StatusEPSS 0.2%CVE-2026-49102MEDIUMWebmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/EPSS 0.2%