Skip to content

CVE-2006-4542

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00")...

6.8 MediumFix available

CVE-2006-4542 is a medium vulnerability (CVSS 6.8) in Usermin, published September 5, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.22%, the 88th percentile. Fixed in webmin 1.180-3sarge1.

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS), read CGI program source code, list directories, and possibly execute programs.

Exploit likelihood

3.22%Down 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS), read CGI program source code, list directories, and possibly execute programs.

Record: CVE-2006-4542
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS), read CGI program source code, list directories, and possibly execute programs.

Record: CVE-2006-4542
Updated: 2026-11-02

EUVDEUVD-2006-4530 No score

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS), read CGI program source code, list directories, and possibly execute programs.

Record: EUVD-2006-4530
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r78v-6mh4-m4rm No score

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00")...

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS), read CGI program source code, list directories, and possibly execute programs.

Record: GHSA-r78v-6mh4-m4rm
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`webmin` Debian:3.1	before 1.180-3sarge1, plus listed versions 1.180-3	1.180-3sarge1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 12 moreShow less