CVE-2019-15107: Webmin Command Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 99.7% chance of exploitation in the next 30 days.

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Affected products

• Webmin Webmin: up to and including 1.920

Published 2019-08-16. Last modified 2026-08-06.