PT-2026-42550

CVE-2026-22678

Published

2026-05-10

Updated

2026-06-24

Description by

CVSS 2.0

5.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 2.641

Description A stored cross-site scripting issue exists in the email template description field of the System and Server Status module. Low-privileged authenticated attackers can execute arbitrary commands by injecting unsanitized input into the 'save tmpl.cgi' endpoint, which is subsequently rendered without escaping in the 'list tmpls.cgi' endpoint.

Recommendations Update to version 2.641 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Hamed Kohi

Vulncheck

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')