CVE-2011-1937: Webmin

Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real (aka Full Name) field, related to useradmin/index.cgi and useradmin/user-lib.pl.

Affected products

• Webmin Webmin: up to and including 1.540; version 0.75 only; version 0.76 only; version 0.77 only; version 0.78 only; version 0.79 only; …

Published 2011-05-31. Last modified 2026-06-16.