🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2019-15107

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Updated Oct 12, 2026View on NVD →

S4E scanner

CVE-2019-15107 Scanner

Targets the password_change.cgi script via old parameter to achieve unauthenticated remote command execution as root.

Used 2.9k times · 3.4k assets checked · domain, ipv4, subdomain

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.