CVE-2026-123622Usermin through 2.570 XSS via mailbox detach.cgi type Parameter

Beschreibung

Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment containing script and lure recipients to a detach.cgi link with type=text/html to run script in the victim's authenticated Usermin session.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Issue #142 issue-tracking
• https://github.com/webmin/usermin product
• Fix commit c5c43b9 patch
• detach.cgi content type handling technical-description
• Researcher write-up technical-description
• VulnCheck Advisory: Usermin through 2.570 XSS via mailbox detach.cgi type Parameter third-party-advisory