CVE-2026-49243— Webmin: Reflected XSS in the Configuration module
Quick assessment
Affected
webmin webmin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49243
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Webmin: Reflected XSS in the Configuration module
Source: CVE Program / CVE List V5
Vulnerability Description
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version 2.650.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-49243
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49243
请登录查看更多情报信息。
Other References for CVE-2026-49243 (3)
-
https://github.com/webmin/webmin/releases/tag/2.650 x_refsource_MISC
-
https://github.com/webmin/webmin/security/advisories/GHSA-hv4w-p8jq-2rp5 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same weakness: CWE-79
-
CVE-2026-97711
Serialize JavaScript: Cross-site scripting (XSS) via unescap -
CVE-2026-76719
HPE OneView - Cross-site scripting vulnerability -
CVE-2026-76718
HPE OneView - Cross-site scripting vulnerability -
CVE-2026-84739
Improper Neutralization of Input During Web Page Generation -
CVE-2026-102292
coolbeans1212 MateisHomePage-Website users.php cross site sc
V. Comments for CVE-2026-49243
No comments yet