Medium severity5.4NVD Advisory· Published Nov 10, 2026· Updated Nov 10, 2026

CVE-2026-125392

Description

Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Webmin/Webminllm-fuzzy
Range: <=2.670

Patches

Vulnerability mechanics

References

github.com/webmin/webmin/blob/2.670/bind8/edit_recs.cginvd
github.com/webmin/webmin/commit/224cbd91467c98c3147df695fe9abc8149183356nvd
www.vulncheck.com/advisories/webmin-through-2.670-stored-xss-via-bind8-edit-recs-cgi-all-viewnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000