Webmin 2.510
Approved changes feed: RSS · Atom
cpe:2.3:a:webmin:webmin:2.510:*:*:*:*:*:*:*
part: a version: 2.510 update: *
| Vendor | Webmin (6926d512-2a2b-58cc-b911-39912c60be84) |
|---|---|
| Product | Webmin (3224cdf7-4b87-5464-81af-0361faa7f4bb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/webmin/webmin |
purl2cpe | 2026-06-01 10:16:23.671394 |
pkg:sourceforge/webadmin |
purl2cpe | 2026-06-01 10:16:23.671396 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-61541 |
vulnerable | 2026-06-08 07:37:27.580521 |
Details available
Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account.
Published: 2025-10-16T00:00:00.000Z
Updated: 2025-10-16T19:02:13.916Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.