CVE-2021-31760

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Mesh3l911/CVE-2021-31760Third Party Advisory
https://github.com/electronicbots/CVE-2021-31760Third Party Advisory
https://github.com/webmin/webminThird Party Advisory
https://youtu.be/D45FN8QrzDoExploit, Third Party Advisory
https://github.com/Mesh3l911/CVE-2021-31760Third Party Advisory
https://github.com/electronicbots/CVE-2021-31760Third Party Advisory
https://github.com/webmin/webminThird Party Advisory
https://youtu.be/D45FN8QrzDoExploit, Third Party Advisory

Timeline

Published: Apr 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-317619.6Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process featur CVE-2021-317628.8Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a CVE-2021-317698.8MyQ Server in MyQ X Smart before 8.2 allows remote code execution by unprivileged users because administrative session data can be read in t CVE-2021-31779.8Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Pyth CVE-2021-317767.8Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the CVE-2021-317774.9The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via CVE-2021-317785.4The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.CVE-2021-317796.4The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.CVE-2021-31786.5fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers CVE-2021-317807.5In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. W CVE-2021-317837.5show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not CVE-2021-317847.8An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6 on all supporte