CVE-2026-125392
Last modified
CVE-2026-125392 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-125392?
How severe is CVE-2026-125392?
How do I fix CVE-2026-125392?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-125387Faveo Helpdesk through 2.0.3 contains an authorization bypas…5.4
- CVE-2026-125388Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58…6.5
- CVE-2026-125389Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58…6.1
- CVE-2026-12539Docker Sandboxes (sbx) blocks ICMP egress with an authorizer…5.7
- CVE-2026-125390Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains …6.5
- CVE-2026-125391Webmin through 2.670 contains an OS command injection vulner…7.2
- CVE-2026-125393MailEnable Enterprise Premium before 10.62 contains a heap o…6.5
- CVE-2026-125394FreeRDP before 3.33.0 contains a heap use-after-free vulnera…5.4
- CVE-2026-125395Ampache before 8.4.0 contains a stored cross-site scripting …5.4
- CVE-2026-125396Ghostscript before 10.08.0 contains a -dSAFER bypass vulnera…7.8
- CVE-2026-125397NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authoriz…7.1
- CVE-2026-125398Instatic before 0.0.21 contains an authorization bypass vuln…7.1
Are you affected by CVE-2026-125392?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST