CVE-2015-2079 — Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open

Back Back to CVE browser

CRITICAL

Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open

Published Apr 28, 2025

9.9

CRITICAL

CVSS 3.1

EPSS 1.54%

Description

Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.

Affected products

Vendor Usermin Product Usermin Default
unaffected
- Version
  0.980
  Status
  affected
  Constraints
  <1.660

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Usermin

unaffected

Version	Status	Constraints
0.980	affected	<1.660

Remediation

No remediation recorded yet.

Metrics

1.54% 0.01536

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01536

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (5 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.54% (0.01536)	73.92th	v5 (v2026.06.15)
Jun 15, 2026	1.00% (0.01004)	58.27th	v5 (v2026.06.15)
Jun 6, 2026	0.94% (0.00944)	76.70th	v4 (v2025.03.14)
Feb 22, 2026	2.79% (0.02785)	85.80th	v4 (v2025.03.14)
Apr 29, 2025	0.57% (0.00569)	67.29th	v4 (v2025.03.14)