CVE-2026-125392

medium

Description

Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.

References

https://www.vulncheck.com/advisories/webmin-through-2.670-stored-xss-via-bind8-edit-recs-cgi-all-view

https://github.com/webmin/webmin/commit/224cbd91467c98c3147df695fe9abc8149183356

https://github.com/webmin/webmin/blob/2.670/bind8/edit_recs.cgi#L271

https://github.com/webmin/webmin

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120555

Details

Source: Mitre, NVD

Published: 2026-11-10

Updated: 2026-11-10

Risk Information

CVSS v2

Base Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 5.4

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 5.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Severity: Medium

EPSS

EPSS: 0.00171