CVE-2026-125392: medium-severity vulnerability in webmin
Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1
Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
webmin · webminRelated CVEs — webmin
In the same product, most dangerous first.
CVE-2026-42210MEDIUMWebmin 2FA requirement bypassEPSS 0.5%CVE-2026-102337MEDIUMWebmin: SSRF exploit in Upload and Download and File Manager modulesEPSS 0.5%CVE-2026-49243CRITICALWebmin: Reflected XSS in the Configuration moduleEPSS 0.3%CVE-2026-125391HIGHWebmin through 2.670 OS Command Injection via Samba User Account OptionsEPSS —CVE-2026-124552MEDIUMWebmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgiEPSS —