Veille CVE

Recherche « Webmin webmin »

9 CVE

Critique 3 Élevée 1 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Webmin webmin » ✕
  1. CVE-2026-49243 9.6 Critique

    webmin

    Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version 2.650.

  2. CVE-2026-42210 5.3 Moyenne

    webmin

    Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. Webmin is a web-based system administration tool for Unix-like servers. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.

  3. CVE-2026-56022 5.3 Moyenne

    Webmin · Webmin webmin

    Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.

  4. CVE-2026-56021 5.3 Moyenne

    Webmin · Webmin webmin

    Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.

  5. CVE-2026-56020 8.1 Élevée

    Webmin

    The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.

  6. CVE-2026-49103 9.4 Critique

    Webmin

    Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.

  7. CVE-2026-49102 6.1 Moyenne

    Webmin

    Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe type (e.g., text/plain).

  8. CVE-2026-22678 5.4 Moyenne

    Webmin · Webmin webmin

    Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.

  9. CVE-2019-15107 9.8 Critique Exploitée Rançongiciel

    Webmin webmin

    An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.