Vulnerability record · CVE-2019-15642 · published 26 August 2019

CVE-2019-15642: Webmin code injection vulnerability

Webmin · Webmin

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."

8.8 CVSS 3.0 High EPSS 35% · top 1.6% CWE-94 · Code injection

8.8CVSS 3.0 base score, v2 6.5

35%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Webmin Webmin

References

Link	Tags
https://doxfer.webmin.com/Webmin/Webmin_Servers_Index	Vendor Advisory
https://github.com/webmin/webmin/blob/ab5e00e41ea1ecc1e24b8f8693f3495a0abb1aed/rpc.cgi#L26-L37	Patch
https://github.com/webmin/webmin/commit/df8a43fb4bdc9c858874f72773bcba597ae9432c	Patch
https://www.calypt.com/blog/index.php/authenticated-rce-on-webmin/	ExploitPatchThird Party Advisory
https://doxfer.webmin.com/Webmin/Webmin_Servers_Index	Vendor Advisory
https://github.com/webmin/webmin/blob/ab5e00e41ea1ecc1e24b8f8693f3495a0abb1aed/rpc.cgi#L26-L37	Patch
https://github.com/webmin/webmin/commit/df8a43fb4bdc9c858874f72773bcba597ae9432c	Patch
https://www.calypt.com/blog/index.php/authenticated-rce-on-webmin/	ExploitPatchThird Party Advisory

Track CVE-2019-15642 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-15107Webmin password_change.cgi command injectionWebmin through 1.920 passes the 'old' parameter in password_change.cgi into a shell command without sanitization, allowing OS command injection. The …KEVEPSS 100%analysed16 Aug 2019 10.0CVE-2005-1177Usermin vulnerabilityUnknown vulnerability in (1) Webmin and (2) Usermin before 1.200 causes Webmin to change permissions and ownership of configuration files, with unkno…EPSS 1.8%2 May 2005 10.0CVE-2003-0101Engardelinux guardian digital webtool vulnerabilityminiserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (…EPSS 15%3 Mar 2003 10.0CVE-2002-2201Webmin vulnerabilityThe Printer Administration module for Webmin 0.990 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the …EPSS 3.3%31 Dec 2002 10.0CVE-2001-1196Webmin vulnerabilityDirectory traversal vulnerability in edit_action.cgi of Webmin Directory 0.91 allows attackers to gain privileges via a '..' (dot dot) in the argumen…EPSS 9.8%17 Dec 2001 9.8CVE-2022-36446Webmin apt-lib.pl command injection via unescaped UI commandWebmin before 1.997 fails to HTML-escape a UI command in software/apt-lib.pl, allowing injection of commands through that interface. The flaw is remo…EPSS 96%analysed25 Jul 2022 9.8CVE-2020-35769Webmin vulnerabilityminiserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.EPSS 1.8%29 Dec 2020 9.8CVE-2018-8712Webmin path traversal vulnerabilityAn issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak d…EPSS 1.8%14 Mar 2018

Source: NIST National Vulnerability Database (record CVE-2019-15642), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.