webmin has been around for centuries and was dropped from Debian in 2005.

It has a long history of vulnerabilities (https://www.cvedetails.com/vulnerability-list/vendor_id-358/...).