CVE-2019-12840

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 77.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-06-15 · updated 2026-06-17
Weakness: CWE-78

Description

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.

Affected products

Webmin: through 1.910

References

http://packetstormsecurity.com/files/153372/Webmin-1.910-Remote-Command-Execution.html
http://www.securityfocus.com/bid/108790
https://pentest.com.tr/exploits/Webmin-1910-Package-Updates-Remote-Command-Execution.html
https://www.exploit-db.com/exploits/46984
http://packetstormsecurity.com/files/153372/Webmin-1.910-Remote-Command-Execution.html
http://www.securityfocus.com/bid/108790
https://pentest.com.tr/exploits/Webmin-1910-Package-Updates-Remote-Command-Execution.html
https://www.exploit-db.com/exploits/46984

Get alerted when CVE-2019-12840 or the next vulnerability affects your stack