CVE-1999-1074
HighExploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
Webmin before 0.5 does not restrict the number of invalid passwords that are entered for a valid username, which could allow remote attackers to gain privileges via brute force password cracking.
Risk Assessment
The lack of restrictions on the number of login attempts may lead to account takeover by attackers, posing a serious security risk to the system.
Recommendation
It is recommended to update Webmin to the latest version to implement restrictions on the number of failed login attempts.
Other vulnerabilities in Webmin
See all- CVE-2017-15645High
CSRF exists in Webmin 1.850, allowing an attacker to execute arbitrary commands by sending a GET request to at/create_job.cgi with dir=/&cmd= in the URI.
- CVE-2017-15644High
There is an SSRF vulnerability in Webmin 1.850 that allows an attacker to exploit the PATH_INFO parameter to make a GET request to tunnel/link.cgi with an external IP address.
- CVE-2019-15107CriticalActively exploited
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
- CVE-2026-42210Medium
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts requiring a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.
- CVE-2026-56022Medium
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.
- CVE-2026-56021Medium
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
- CVE-2026-56020High
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. An attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.
- CVE-2026-22678Medium
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module. Low-privileged authenticated attackers can execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.
- CVE-2023-40983Medium
A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Find in Results' file.
- CVE-2023-40982Medium
Webmin version 2.100 contains a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious HTML or JavaScript code via the cloned module name parameter.
Original NVD description (English source)
Webmin before 0.5 does not restrict the number of invalid passwords that are entered for a valid username, which could allow remote attackers to gain privileges via brute force password cracking.