Servers and applications
CVE-2019-15642
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."
- Severity
- High 8.8
- Published
- 26 Aug 2019
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 37% in the next 30 daysHigher than 98% of CVEs. EPSS by FIRST, 10 Nov 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
WebminServers and applications · cpe:a:webmin:webmin |
|