Medium severity6.1NVD Advisory· Published Nov 6, 2026
CVE-2026-123622
CVE-2026-123622
Description
Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment containing script and lure recipients to a detach.cgi link with type=text/html to run script in the victim's authenticated Usermin session.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/webmin/usermin/blob/2.570/mailbox/detach.cginvd
- github.com/webmin/usermin/commit/c5c43b9ad04a60809ac2eb271bf8f3d0fec2e46anvd
- github.com/webmin/usermin/issues/142nvd
- hackmd.io/@leediay/H144QKY6zlnvd
- www.vulncheck.com/advisories/usermin-through-2.570-xss-via-mailbox-detach-cgi-type-parameternvd
News mentions
0No linked articles in our index yet.