WE
Vendor
webmin
125
CVEs
1
On KEV
0
New 30D
Products
WE9.8
webmin
webmin
102 CVEs1 on KEV0 new
US8.8
Usermin
Webmin
22 CVEs0 on KEV0 new
US–
Userwin
Webmin
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-49243 | WE webmin webmin | 9.6 | Sep 29 | Webmin: Reflected XSS in the Configuration module |
| CVE-2026-42210 | WE webmin webmin | 5.3 | Jul 20 | Webmin 2FA requirement bypass |
| CVE-2026-56020 | WE Webmin Webmin | 8.1 | Jun 18 | Webmin HTTP header authentication bypass |
| CVE-2026-56021 | WE Webmin Webmin | 5.3 | Jun 18 | Webmin information disclosure via regex pattern |
| CVE-2026-56022 | WE Webmin Webmin | 5.3 | Jun 18 | Webmin MFA bypass |
| CVE-2026-49103 | WE Webmin Webmin | 9.4 | May 27 | Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component |
| CVE-2026-49102 | WE Webmin Webmin | 6.1 | May 27 | Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe type… |
| CVE-2026-22678 | WE Webmin Webmin | 5.4 | May 21 | Webmin < 2.641 Stored XSS via System and Server Status |
| CVE-2025-67738 | WE Webmin Webmin | 8.5 | Dec 11 | squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments |
| CVE-2025-61541 | WE Webmin Webmin | 7.1 | Oct 16 | Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi) |
| CVE-2015-2079 | US Usermin Webmin | 8.8 | Apr 28 | Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open |
| CVE-2024-12828 | WE Webmin Webmin | 8.8 | Dec 30 | Webmin CGI Command Injection Remote Code Execution Vulnerability |
| CVE-2024-44762 | US Usermin Webmin | 5.3 | Oct 16 | A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts |
| CVE-2024-45692 | WE Webmin Webmin | 7.5 | Sep 4 | Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000 |
| CVE-2024-36453 | WE Webmin Webmin | 6.1 | Jul 10 | Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820 |
| CVE-2024-36452 | WE Webmin Webmin | 3.1 | Jul 10 | Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003 |
| CVE-2024-36451 | WE Webmin Webmin | 8.8 | Jul 10 | Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003 |
| CVE-2024-36450 | WE Webmin Webmin | 5.4 | Jul 10 | Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910 |
| CVE-2023-52046 | WE Webmin Webmin | 4.8 | Jan 25 | Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute cron job as" tab… |
| CVE-2023-43309 | WE Webmin Webmin | 4.8 | Sep 21 | There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by… |
| CVE-2023-41157 | US Usermin Webmin | 5.4 | Sep 16 | Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name parameter while… |
| CVE-2023-40985 | WE Webmin Webmin | 5.4 | Sep 15 | An issue was discovered in Webmin 2.100 |
| CVE-2023-40983 | WE Webmin Webmin | 6.1 | Sep 15 | A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload… |
| CVE-2023-40982 | WE Webmin Webmin | 5.4 | Sep 15 | A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module… |
| CVE-2023-40986 | WE Webmin Webmin | 5.4 | Sep 15 | A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted… |
| CVE-2023-40984 | WE Webmin Webmin | 5.4 | Sep 15 | A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload… |
| CVE-2023-41156 | US Usermin Webmin | 5.4 | Sep 14 | A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the save… |
| CVE-2023-41160 | US Usermin Webmin | 5.4 | Sep 14 | A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the key name… |
| CVE-2023-41159 | US Usermin Webmin | 5.4 | Sep 14 | A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML by editing… |
| CVE-2023-41162 | US Usermin Webmin | 6.1 | Sep 13 | A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the file mask… |
| CVE-2023-41158 | US Usermin Webmin | 5.4 | Sep 13 | A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the description… |
| CVE-2023-41155 | US Usermin Webmin | 5.4 | Sep 13 | A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML… |
| CVE-2023-41154 | US Usermin Webmin | 5.4 | Sep 13 | A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value… |
| CVE-2023-41152 | US Usermin Webmin | 5.4 | Sep 13 | A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the handle… |
| CVE-2023-41161 | US Usermin Webmin | 5.4 | Sep 7 | Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages… |
| CVE-2023-41163 | WE Webmin Webmin | 6.1 | Aug 30 | A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in… |
| CVE-2023-41153 | US Usermin Webmin | 5.4 | Aug 29 | A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via options for the… |
| CVE-2023-38304 | WE Webmin Webmin | 5.4 | Jul 31 | An issue was discovered in Webmin 2.021 |
| CVE-2023-38303 | WE Webmin Webmin | 5.4 | Jul 31 | An issue was discovered in Webmin 2.021 |
| CVE-2023-38311 | WE Webmin Webmin | 5.4 | Jul 31 | An issue was discovered in Webmin 2.021 |
| CVE-2023-38310 | WE Webmin Webmin | 5.4 | Jul 31 | An issue was discovered in Webmin 2.021 |
| CVE-2023-38309 | WE Webmin Webmin | 6.1 | Jul 31 | An issue was discovered in Webmin 2.021 |
| CVE-2023-38308 | WE Webmin Webmin | 6.1 | Jul 31 | An issue was discovered in Webmin 2.021 |
| CVE-2023-38307 | WE Webmin Webmin | 5.4 | Jul 31 | An issue was discovered in Webmin 2.021 |
| CVE-2023-38306 | WE Webmin Webmin | 6.1 | Jul 31 | An issue was discovered in Webmin 2.021 |
| CVE-2023-38305 | WE Webmin Webmin | 6.1 | Jul 31 | An issue was discovered in Webmin 2.021 |
| CVE-2022-3844 | WE Webmin Webmin | 6.1 | Nov 2 | Webmin index.cgi cross site scripting |
| CVE-2022-35132 | US Usermin Webmin | 8.8 | Oct 25 | Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module |
| CVE-2022-36880 | US Usermin Webmin | 6.1 | Jul 27 | The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message |
| CVE-2022-36446 | WE Webmin Webmin | 9.8 | Jul 25 | software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command |
| CVE-2022-30708 | WE Webmin Webmin | 8.8 | May 15 | Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin) |
| CVE-2021-32162 | WE Webmin Webmin | 8.8 | Apr 11 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature |
| CVE-2021-32161 | WE Webmin Webmin | 6.1 | Apr 11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature |
| CVE-2021-32160 | WE Webmin Webmin | 6.1 | Apr 11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature |
| CVE-2021-32159 | WE Webmin Webmin | 8.8 | Apr 11 | A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature |
| CVE-2021-32158 | WE Webmin Webmin | 6.1 | Apr 11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature |
| CVE-2021-32157 | WE Webmin Webmin | 9.6 | Apr 11 | A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature |
| CVE-2021-32156 | WE Webmin Webmin | 8.8 | Apr 11 | A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature |
| CVE-2022-0829 | WE Webmin Webmin | 8.1 | Mar 2 | Improper Authorization in GitHub repository webmin/webmin prior to 1.990 |
| CVE-2022-0824 | WE Webmin Webmin | 8.8 | Mar 2 | Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990 |