Actively exploited in the wild

Webmin Command Injection Vulnerability

Webmin - Webmin · Listed in the CISA KEV since 2022-03-25. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2019-15107

CriticalCVSS 9.8KEV

Published: 16/08/2019(UTC)Updated: 04/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

99.77%

100th percentile - higher than 100% of all known CVEs

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

An attacker can execute arbitrary commands on the server, potentially leading to full system compromise and data breach.

Update Webmin to the latest version and restrict access to the administrative panel.

Original NVD description (English source)

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.