Webmin vulnerabilities

CVEs per yearBy the year they were published

1. 20171
2. 20222
3. 20245
4. 20251
5. 20269

Newest CVEs

• CVE-2026-102337

  Webmin: SSRF exploit in Upload and Download and File Manager modules

  webmin · webmin

  Medium4.9
• CVE-2026-49243

  Webmin: Reflected XSS in the Configuration module

  webmin · webmin

  Critical9.6
• CVE-2026-42210

  Webmin 2FA requirement bypass

  webmin · webmin

  Medium5.3
• CVE-2026-56020

  Webmin HTTP header authentication bypass

  Webmin · Webmin

  Critical9.2
• CVE-2026-56021

  Webmin information disclosure via regex pattern

  Webmin · Webmin

  Medium6.9
• CVE-2026-56022

  Webmin MFA bypass

  Webmin · Webmin

  Medium6.9
• CVE-2026-49103

  Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.

  Webmin · Webmin

  Critical9.4
• CVE-2026-49102

  Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used…

  Webmin · Webmin

  Medium6.1
• CVE-2026-22678

  Webmin < 2.641 Stored XSS via System and Server Status

  Webmin · Webmin

  Medium5.1
• CVE-2025-67738

  squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are…

  Webmin · Webmin

  High8.5