CVE-2005-3912

CVE-2005-3912 describes a format string vulnerability in the miniserv.pl Perl web server used by Webmin before 1.250 and Usermin before 1.180, specifically when syslog logging is enabled. Remote attackers can exploit this by injecting format string specifiers into the username parameter of the login form, leading to a denial of service (crash or memory consumption) and potentially arbitrary code execution. The vulnerability has a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low attack complexity, and potential for partial confidentiality, integrity, and availability impact. The EPSS score is 0.12453, suggesting a relatively low probability of exploitation. There is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, aligning with the majority of reported vulnerabilities.