CVE-2019-15641

MEDIUM

Webmin < 1.930 - Authenticated XML External Entity Injection via xmlrpc.cgi

Title source: llm

xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

CVSS v3 6.5

EPSS 0.0145

EPSS Percentile 70.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-611

Status published

Products (1)

webmin/webmin < 1.930

Published Aug 26, 2019

Tracked Since Feb 18, 2026