CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.4. It affects Java. Exploitation may require the attacker to be authenticated.
CVE
CVE-2026-22678
Severity
MEDIUM
CVSS
5.4
EPSS
0.22%
Java
Original NVD Description
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.
Related CVEs
Other vulnerabilities affecting the same vendor(s)