See how webmin compares to other vendors in security performance
An issue was discovered in Webmin <=1.920. The parameter old in passwordchange.cgi contains a command injection vulnerability.
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.