CVE-2026-125392: falha de média gravidade em webmin
Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1
Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
webmin · webminCVEs relacionadas — webmin
No mesmo produto, das mais perigosas para as menos.
CVE-2026-42210MEDIUMWebmin 2FA requirement bypassEPSS 0.5%CVE-2026-102337MEDIUMWebmin: SSRF exploit in Upload and Download and File Manager modulesEPSS 0.5%CVE-2026-49243CRITICALWebmin: Reflected XSS in the Configuration moduleEPSS 0.3%CVE-2026-124552MEDIUMWebmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgiEPSS 0.2%CVE-2026-125391HIGHWebmin through 2.670 OS Command Injection via Samba User Account OptionsEPSS —