CVE-2019-15107 — Webmin Command Injection Vulnerability

CVE-2019-15107

CRITICAL · CVSS 9.8 ⚠ KEV — EXPLOITED

EPSS exploitation probability: 100%

⚠ Listed in the CISA Known Exploited Vulnerabilities catalog — actively exploited.

Published 2022-03-25 · Last modified 2026-08-04T05:16:26.863

Summary

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Webmin — Webmin

Add your gear to cvedb and we'll alert you only when Webmin ships something exploited.

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.