Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39 results
Apr 28, 2025Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form ofCVE-2015-2079 · Other software · Usermin · reported by MITRECritical 9.9
Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode-white.comcode-white.com
Oct 16, 2024A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.CVE-2024-44762 · Other software · webmin · reported by MITREMedium 5.3
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.
- Product
- usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820.CVE-2024-36453 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a webpage may be altered or sensitive information such as a credential may be disclosed.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2023Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name paCVE-2023-41157 · Other software · Webmin · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the folder name parameter while creating the folder to manage the folder tab, filter tab, and forward mail tab.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTMCVE-2023-40986 · Other software · Webmin · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted payload injected into the Custom field.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML vCVE-2023-41160 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the key name field while adding an authorized key.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script CVE-2023-41159 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML by editing the forward file manually.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or CVE-2023-41156 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the save to new folder named field while creating a new filter.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML viaCVE-2023-41162 · Other software · Webmin · reported by MITREMedium 6.1
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the file mask field while searching under the tools drop down.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML CVE-2023-41158 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the description field while creating a new MIME type program.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitraryCVE-2023-41155 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the forward to field while creating a mail forwarding rule.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTMLCVE-2023-41154 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML CVE-2023-41152 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the handle program field while creating a new MIME type program.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2023Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment toCVE-2023-41161 · Other software · Webmin · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML viaCVE-2023-41163 · Other software · Webmin · reported by MITREMedium 6.1
A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the replace in results field while replacing the results under the tools drop down.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2023A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML vCVE-2023-41153 · Other software · Webmin · reported by MITREMedium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via options for the host value while editing the host options.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.CVE-2022-35132 · Other software · Webmin · reported by MITREHigh 8.8
Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2022The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message.CVE-2022-36880 · Other software · Webmin · reported by MITREMedium 6.1
The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2017Multiple cross-site scripting (XSS) vulnerabilities in (1) filter/save_forward.cgi, (2) filter/save.cgi, (3) /man/search.cgi in Usermin before 1.690.CVE-2016-4897 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in (1) filter/save_forward.cgi, (2) filter/save.cgi, (3) /man/search.cgi in Usermin before 1.690.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2014Cross-site scripting (XSS) vulnerability in Usermin before 1.600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2014-3884 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Usermin before 1.600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2014Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action.CVE-2014-3883 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 6.8
Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2014Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HTMCVE-2014-3924 · Other software · Webmin · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HTML via vectors related to popup windows.
- Product
- Userwin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Jan 5, 2010Cross-site scripting (XSS) vulnerability in Webmin before 1.500 and Usermin before 1.430 allows remote attackers to inject arbitrary web script or HTML via unspCVE-2009-4568 · Other software · Webmin · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Webmin before 1.500 and Usermin before 1.430 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.commandriva.com
Feb 11, 2008Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary web script or HTML viCVE-2008-0720 · Other software · Webmin · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary web script or HTML via the search parameter to webmin_search.cgi (aka the search section), and possibly other components accessed through a "search box" or "open file box." NOTE: some of these details are obtained from third party information.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.aria-security.netsecunia.com
Jun 11, 2007Multiple cross-site scripting (XSS) vulnerabilities in pam_login.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers to inject arbitrary CVE-2007-3156 · Other software · Webmin · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in pam_login.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) message, or (3) question parameter. NOTE: some of these details are obtained from third party information.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2007Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary weCVE-2007-1276 · Other software · Usermin · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2006Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameteCVE-2006-4246 · Other software · Usermin · reported by security@debian.orgLow 3.6
Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Sep 5, 2006Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scrCVE-2006-4542 · Other software · Usermin · reported by MITREMedium 6.8
Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS), read CGI program source code, list directories, and possibly execute programs.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2006Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as deCVE-2006-3392 · Other software · Usermin · reported by MITREMedium 5
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordattrition.orgattrition.org
Nov 30, 2005Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackersCVE-2005-3912 · Other software · Webmin · reported by MITREHigh 7.5
Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service (crash or memory consumption) and possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is ultimately used in a syslog call. NOTE: the code execution might be associated with an issue in Perl.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.immunitysec.comsecunia.com
Sep 22, 2005miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofCVE-2005-3042 · Other software · Usermin · reported by MITREHigh 7.5
miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return).
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comjvn.jp
May 2, 2005Unknown vulnerability in (1) Webmin and (2) Usermin before 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.CVE-2005-1177 · Other software · Usermin · reported by MITREHigh 10
Unknown vulnerability in (1) Webmin and (2) Usermin before 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comwebmin.com
Dec 31, 2004The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message.CVE-2004-1468 · Other software · Usermin · reported by MITREHigh 7.5
The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2004The maketemp.pl script in Usermin 1.070 and 1.080 allows local users to overwrite arbitrary files at install time via a symlink attack on the /tmp/.usermin direCVE-2004-0559 · Other software · Usermin · reported by MITRELow 2.1
The maketemp.pl script in Usermin 1.070 and 1.080 allows local users to overwrite arbitrary files at install time via a symlink attack on the /tmp/.usermin directory.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2004Cross-site scripting (XSS) vulnerability in the web mail module for Usermin 1.070 allows remote attackers to insert arbitrary HTML and script via e-mail messageCVE-2004-0588 · Other software · Usermin · reported by MITREMedium 6.8
Cross-site scripting (XSS) vulnerability in the web mail module for Usermin 1.070 allows remote attackers to insert arbitrary HTML and script via e-mail messages.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2004The account lockout functionality in (1) Webmin 1.140 and (2) Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct aCVE-2004-0583 · Other software · Usermin · reported by MITREMedium 5
The account lockout functionality in (1) Webmin 1.140 and (2) Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2003miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in BaCVE-2003-0101 · Other software · Engardelinux · reported by MITREHigh 10
miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges.
- Product
- Guardian Digital Webtool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpatches.sgi.comarchives.neohapsis.com
Aug 12, 2002(1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via cCVE-2002-0757 · Other software · Usermin · reported by MITREHigh 7.5
(1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordonline.securityfocus.comiss.net
Aug 12, 2002Cross-site scripting vulnerability in the authentication page for (1) Webmin 0.96 and (2) Usermin 0.90 allows remote attackers to insert script into an error paCVE-2002-0756 · Other software · Usermin · reported by MITREHigh 7.5
Cross-site scripting vulnerability in the authentication page for (1) Webmin 0.96 and (2) Usermin 0.90 allows remote attackers to insert script into an error page and possibly steal cookies.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comiss.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.