CVE-2019-15642

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."

• CWE-94

• https://doxfer.webmin.com/Webmin/Webmin_Servers_IndexVendor Advisory
• https://github.com/webmin/webmin/blob/ab5e00e41ea1ecc1e24b8f8693f3495a0abb1aed/rpc.cgi#L26-L37Patch
• https://github.com/webmin/webmin/commit/df8a43fb4bdc9c858874f72773bcba597ae9432cPatch
• https://www.calypt.com/blog/index.php/authenticated-rce-on-webmin/Exploit, Patch, Third Party Advisory
• https://doxfer.webmin.com/Webmin/Webmin_Servers_IndexVendor Advisory
• https://github.com/webmin/webmin/blob/ab5e00e41ea1ecc1e24b8f8693f3495a0abb1aed/rpc.cgi#L26-L37Patch
• https://github.com/webmin/webmin/commit/df8a43fb4bdc9c858874f72773bcba597ae9432cPatch
• https://www.calypt.com/blog/index.php/authenticated-rce-on-webmin/Exploit, Patch, Third Party Advisory

Published

Aug 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15637Numerous Tableau products are vulnerable to XXE via a malici…8.1
• CVE-2019-15638COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontro…7.8
• CVE-2019-15639main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allo…7.5
• CVE-2019-1564Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15640Limesurvey before 3.17.10 does not validate both the MIME ty…
• CVE-2019-15641xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE …
• CVE-2019-15643The ultimate-faqs plugin before 1.8.22 for WordPress has XSS…
• CVE-2019-15644The zoho-salesiq plugin before 1.0.9 for WordPress has store…
• CVE-2019-15645The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
• CVE-2019-15646The rsvpmaker plugin before 6.2 for WordPress has SQL inject…
• CVE-2019-15647The groundhogg plugin before 1.3.5 for WordPress has wp-admi…
• CVE-2019-15648The insert-or-embed-articulate-content-into-wordpress plugin…