Vulnerabilidades do Webmin Webmin

CVE-2026-49243 Crítica · 9.6 CWE-79 29/09/2026

Webmin: Reflected XSS in the Configuration module

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version 2.650.

CVE-2026-56022 Média · 5.3 CWE-308 18/06/2026

Webmin MFA bypass

Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.

CVE-2026-56021 Média · 5.3 CWE-185 18/06/2026

Webmin information disclosure via regex pattern

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.

CVE-2026-56020 Alta · 8.1 CWE-290 18/06/2026

Webmin HTTP header authentication bypass

The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.

CVE-2026-49103 Crítica · 9.4 CWE-24 27/05/2026

Webmin before 2.640 does not safely construct a filename for saving of an attachment…

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.

CVE-2026-49102 Média · 6.1 CWE-79 27/05/2026

Cross-site Scripting (XSS) em Webmin

Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe type (e.g., text/plain).

CVE-2026-22678 Média · 5.4 CWE-79 21/05/2026

Webmin < 2.641 Stored XSS via System and Server Status

Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.

CVE-2025-67738 Alta · 8.5 CWE-78 11/12/2025

squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if...

squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are available, and an untrusted party is able to authenticate to Webmin and has certain Cache Manager permissions (the "cms" security option).

CVE-2025-61541 Alta · 7.1 CWE-284 16/10/2025

Improper Access Control em Webmin

Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.

CVE-2019-15107 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-78 16/08/2019

Webmin Command Injection Vulnerability

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.