CVE-2026-22678— Webmin < 2.641 Stored XSS via System and Server Status
Possible ATT&CK Techniques 1AI
T1189 · Drive-by CompromiseGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-22678
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Webmin < 2.641 Stored XSS via System and Server Status
Source: NVD (National Vulnerability Database)
Vulnerability Description
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary commands by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Webmin 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Webmin是Webmin社区的一套基于Web的用于类Unix操作系统中的系统管理工具。 Webmin 2.641之前版本存在跨站脚本漏洞，该漏洞源于System and Server Status模块的电子邮件模板描述字段存在存储型跨站脚本漏洞，可能导致低权限攻击者执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-22678
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-22678
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-22678 (1)
- Webmin < 2.641 Stored XSS via System and Server Status | Advisories | VulnCheckthird-party-advisory
Vendor Pages for CVE-2026-22678 (1)
IV. Related Vulnerabilities
Same weakness: CWE-79
- CVE-2026-9471
yashpokharna2555 StudentManagementSystem student.php cross s - CVE-2026-9448
code-projects Employee Management System applyleave.php cros - CVE-2026-45249
Apache ECharts: XSS in Lines series tooltip rendering - CVE-2026-9419
code-projects Employee Management System empproject.php cros - CVE-2026-9418
code-projects Employee Management System changepassemp.php c
V. Comments for CVE-2026-22678
No comments yet