usermin vulnerabilities
CVEs whose affected-version data names the usermin package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-123620High· 7.5Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metach…
CVE-2026-123621High· 8.8PoCUsermin through 2.570 Path Traversal File Write via detachall.cgi
Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email …
CVE-2026-123622Medium· 6.1Usermin through 2.570 XSS via mailbox detach.cgi type Parameter
Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an …