U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Keyword (text search): cpe:2.3:a:webmin:webmin:1.970:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 7 matching records.
Displaying matches 1 through 7.
Vuln ID Summary CVSS Severity
CVE-2024-45692

Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.

Published: September 04, 2024; 7:15:12 PM -0400 		V4.0:(not available)
 V3.1: 7.5 HIGH
V2.0:(not available)
CVE-2023-52046

Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute cron job as" tab Input field.

Published: January 25, 2024; 4:15:08 PM -0500 		V4.0:(not available)
 V3.1: 4.8 MEDIUM
V2.0:(not available)
CVE-2023-43309

There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows attackers to run malicious scripts by injecting a specially crafted payload.

Published: September 21, 2023; 10:15:10 AM -0400 		V4.0:(not available)
 V3.1: 4.8 MEDIUM
V2.0:(not available)
CVE-2022-36446

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

Published: July 25, 2022; 2:15:07 AM -0400 		V4.0:(not available)
 V3.1: 9.8 CRITICAL
V2.0:(not available)
CVE-2022-30708

Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.

Published: May 14, 2022; 11:15:07 PM -0400 		V4.0:(not available)
 V3.1: 8.8 HIGH
V2.0: 6.5 MEDIUM
CVE-2022-0829

Improper Authorization in GitHub repository webmin/webmin prior to 1.990.

Published: March 02, 2022; 7:15:07 AM -0500 		V4.0:(not available)
 V3.1: 8.1 HIGH
V2.0: 5.5 MEDIUM
CVE-2022-0824

Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.

Published: March 02, 2022; 7:15:07 AM -0500 		V4.0:(not available)
 V3.1: 8.8 HIGH
V2.0: 9.0 HIGH