CVE-2019-15107

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Aug 6, 2026

Description

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Aug 16, 2019
Last modified
Aug 6, 2026
Added to CISA KEV
Mar 25, 2022
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-151084.8An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-uploaCVE-2019-151096.1The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.CVE-2019-151106.1The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.CVE-2019-151119.8The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.CVE-2019-151126.1The wp-slimstat plugin before 4.8.1 for WordPress has XSS.CVE-2019-151138.8The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.CVE-2019-151148.8The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.CVE-2019-151158.8The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.CVE-2019-151166.1The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.CVE-2019-151177.8parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to out-of-bounds memoryCVE-2019-151185.5check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion.CVE-2019-151195.5lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwr
CVE-2019-15107: Critical severity, CVSS 9.8 | Vulnix