CVE-2026-125392

MEDIUM 5.4

Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.

CWE	CWE-79
Vendor	webmin
Product	webmin
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for webmin webmin

Be the first to know when new medium vulnerabilities affecting webmin webmin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

webmin / webmin

0 ≤ 2.670

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/webmin/webmin/commit/224cbd91467c98c3147df695fe9abc8149183356 github.com: https://github.com/webmin/webmin github.com: https://github.com/webmin/webmin/blob/2.670/bind8/edit_recs.cgi#L271 vulncheck.com: https://www.vulncheck.com/advisories/webmin-through-2.670-stored-xss-via-bind8-edit-recs-cgi-all-view

Credits

Sakil Ahamed Gayen Jamie Cameron