CVE-2006-4542: Usermin

Medium severity, CVSS 6.8. EPSS: 3.2% chance of exploitation in the next 30 days.

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS), read CGI program source code, list directories, and possibly execute programs.

Affected products

• Usermin Usermin: up to and including 1.220; version 0.4 only; version 0.5 only; version 0.6 only; version 0.7 only; version 0.8 only; …
• Webmin Webmin: up to and including 1.2.90; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …

Published 2006-09-05. Last modified 2026-06-16.