Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process featu…

published 2021-04-25 5y ago modified 2026-06-17 4mo ago also EUVD-2021-18645

cvss: 9.6; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 33.6%; EPSS 33.6% chance of exploitation in 30 days, percentile 98%
public exploits: 1; Exploit-DB

Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.

Is CVE-2021-31761 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2021-04-25 Published
2021-07-20 First public exploit (EDB-50144)

Exploit prediction

33.57% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-50144 Webmin 1.973 - 'run.cgi' Cross-Site Request Forgery (CSRF) webapps, 2021-07-20
youtu.be https://youtu.be/23VvUMu-28c referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/Mesh3l911/CVE-2021-31761 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/electronicbots/CVE-2021-31761 referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

youtu.be /23VvUMu-28c
exploit, third-party-advisory
github.com /Mesh3l911/CVE-2021-31761
exploit, third-party-advisory
github.com /electronicbots/CVE-2021-31761
exploit, third-party-advisory
packetstormsecurity.com /files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html
exploit, third-party-advisory, vdb-entry
github.com /webmin/webmin
product, third-party-advisory

Sources

CVE List CVE-2021-31761
NVD CVE-2021-31761

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.