Sploitus

72 exploited vulnerabilities in Webmin

Showing 1–50 of 72, highest-scoring first

Vendors
Webmin, Red Os, Unknown, Usermin, Jamie Cameron
With known exploits
72
Affected Webmin versions
< 1.997, 1.920, 1.0.50, 1.0.60, 1.973, 0.21, 0.22, 0.31, 0.41, 0.42, 0.51, 0.76, 0.77, 0.78, 0.79, 0.80, 0.85, 0.88, 0.91, 0.92, 0.93, 0.94, 0.950, 0.960, 0.970, 0.980, 0.990, 1.990, 1.962, 1.910, 1.850, 1.900
Affected Engardelinux Guardian Digital Webtool versions
= 1.2
Affected Usermin versions
= 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.91, 0.92, 0.93, 0.94, 0.95, 0.96, 0.97, 0.98, 0.99
Affected Gentoo Webmin versions
≤ 1.590, 1.140, 1.150, 1.160, 1.170, 1.180, 1.200, 1.210, 1.220, 1.230, 1.240, 1.260, 1.270, 1.280, 1.290, 1.300, 1.310, 1.320, 1.330, 1.340, 1.370, 1.380, 1.390, 1.400, 1.410, 1.420, 1.430, 1.440, 1.450, 1.470, 1.480, 1.500, 1.510, 1.520, 1.530, 1.550, 1.560, 1.570, 1.580

Vulnerabilities with exploits

Highest CVSS first — 18 of these already have exploit code on Sploitus

CVE-2022-36446 7 exploits
CVSS 10.0 CRITICAL 2022-07-25FIX AVAILABLE
Exploit for Improper Encoding or Escaping of Output in WebminWebmin Package Updates RCE
CVE-2019-15107 38 exploits
CVSS 10.0 CRITICAL 2019-08-16FIX AVAILABLE
Exploit for OS Command Injection in Webmincreate-poc-template-skills
CVE-2003-0101 1 exploit
CVSS 10.0 HIGH 2003-02-26FIX AVAILABLE
Webmin 0.9x / Usermin 0.9x/1.0 - Access Session ID Spoofing
CVE-2024-12828
CVSS 9.9 CRITICAL 2024-03-28FIX AVAILABLE
CVE-2021-32157 1 exploit
CVSS 9.6 CRITICAL 2022-04-11FIX AVAILABLE
Exploit for Cross-site Scripting in Webmin
CVE-2021-31761 5 exploits
CVSS 9.6 CRITICAL 2021-04-25
Webmin 1.973 - (run.cgi) Cross-Site Request Forgery VulnerabilityWebmin 1.973 - 'run.cgi' Cross-Site Request Forgery (CSRF)
CVE-2026-49103
CVSS 9.4 CRITICAL 2026-05-27FIX AVAILABLE
CVE-2002-2360 1 exploit
CVSS 9.3 HIGH 2002-12-31FIX AVAILABLE
Webmin 0.x - 'RPC' Privilege Escalation
CVE-2026-56020
CVSS 9.2 CRITICAL 2026-06-18FIX AVAILABLE
CVE-2025-2774
CVSS 9.0 HIGH 2025-05-01FIX AVAILABLE
CVE-2024-36451
CVSS 9.0 HIGH 2024-07-10FIX AVAILABLE
CVE-2022-0824 12 exploits
CVSS 9.0 HIGH 2022-02-17FIX AVAILABLE
Exploit for Improper Access Control in WebminExploit for Improper Access Control in Webmin
CVE-2020-35606 2 exploits
CVSS 9.0 HIGH 2020-12-21FIX AVAILABLE
Webmin 1.962 - 'Package Updates' Escape Bypass RCE (Metasploit)Webmin 1.962 Remote Command Execution
CVE-2019-12840 8 exploits
CVSS 9.0 HIGH 2019-06-15FIX AVAILABLE
Exploit for OS Command Injection in WebminWebmin 1.962 Remote Command Execution
CVE-2022-30708
CVSS 8.8 HIGH 2022-05-15
CVE-2021-32162
CVSS 8.8 HIGH 2022-04-11FIX AVAILABLE
CVE-2021-32159
CVSS 8.8 HIGH 2022-04-11
CVE-2021-32156
CVSS 8.8 HIGH 2022-04-11FIX AVAILABLE
CVE-2021-31762 5 exploits
CVSS 8.8 HIGH 2021-04-25FIX AVAILABLE
Webmin 1.973 - Cross-Site Request Forgery (CSRF) ExploitWebmin 1.973 - 'save_user.cgi' Cross-Site Request Forgery (CSRF)
CVE-2021-31760 2 exploits
CVSS 8.8 HIGH 2021-04-25
Exploit for Cross-Site Request Forgery (CSRF) in WebminExploit for Cross-Site Request Forgery (CSRF) in Webmin
CVE-2019-15642 3 exploits
CVSS 8.8 HIGH 2019-08-26FIX AVAILABLE
Exploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_PlatformExploit for Deserialization of Untrusted Data in Redhat Jboss_Enterprise_Application_Platform
CVE-2017-15645 1 exploit
CVSS 8.8 HIGH 2017-10-19
Webmin 1.850 - Multiple Vulnerabilities
CVE-2017-15644 1 exploit
CVSS 8.6 HIGH 2017-10-19FIX AVAILABLE
Webmin 1.850 - Multiple Vulnerabilities
CVE-2025-67738
CVSS 8.5 HIGH 2025-12-11FIX AVAILABLE
CVE-2025-61541
CVSS 8.5 HIGH 2025-10-11
CVE-2024-45692
CVSS 7.8 HIGH 2024-09-04FIX AVAILABLE
CVE-2019-9624 3 exploits
CVSS 7.8 HIGH 2019-03-07FIX AVAILABLE
Exploit for Improper Privilege Management in WebminWebmin Upload Authenticated RCE
CVE-2004-1468
CVSS 7.5 HIGH 2004-09-12FIX AVAILABLE
CVE-2002-0757
CVSS 7.5 HIGH 2002-07-26FIX AVAILABLE
CVE-2001-1074
CVSS 7.2 HIGH 2001-05-28FIX AVAILABLE
CVE-2026-56022
CVSS 6.9 MEDIUM 2026-06-18FIX AVAILABLE
CVE-2026-56021
CVSS 6.9 MEDIUM 2026-06-18
CVE-2019-15641
CVSS 6.8 MEDIUM 2019-08-26FIX AVAILABLE
CVE-2012-2982 9 exploits
CVSS 6.5 MEDIUM 2012-09-11FIX AVAILABLE
Exploit for CVE-2012-2982Webmin show.cgi Open Function Call Command Execution
CVE-2024-36453
CVSS 6.4 MEDIUM 2024-07-09FIX AVAILABLE
CVE-2023-38306
CVSS 6.4 MEDIUM 2023-07-31
CVE-2023-38305
CVSS 6.4 MEDIUM 2023-07-31
CVE-2023-38308
CVSS 6.4 MEDIUM 2023-07-31
CVE-2026-49102
CVSS 6.1 MEDIUM 2026-05-27FIX AVAILABLE
CVE-2023-40983
CVSS 6.1 MEDIUM 2023-09-14FIX AVAILABLE
CVE-2023-38309
CVSS 6.1 MEDIUM 2023-07-31
CVE-2022-36880
CVSS 6.1 MEDIUM 2022-07-27FIX AVAILABLE
CVE-2021-32161
CVSS 6.1 MEDIUM 2022-04-11FIX AVAILABLE
CVE-2021-32160
CVSS 6.1 MEDIUM 2022-04-11FIX AVAILABLE
CVE-2021-32158
CVSS 6.1 MEDIUM 2022-04-11FIX AVAILABLE
CVE-2017-9313 2 exploits
CVSS 6.1 MEDIUM 2017-07-04FIX AVAILABLE
Webmin 1.840 Cross Site Scripting VulnerabilityWebmin 1.840 Cross Site Scripting
CVE-2017-15646 1 exploit
CVSS 6.1 MEDIUM 2017-10-19FIX AVAILABLE
Webmin 1.850 - Multiple Vulnerabilities
CVE-2023-38307
CVSS 5.8 MEDIUM 2023-07-31
CVE-2026-22678
CVSS 5.5 MEDIUM 2026-05-10FIX AVAILABLE
CVE-2024-36450
CVSS 5.5 MEDIUM 2024-07-09FIX AVAILABLE