Webmin Stored Cross-Site Scripting Vulnerability in System and Server Status Module

A stored cross-site scripting vulnerability has been identified in Webmin versions prior to 2.641. The issue resides in the email template description field of the System and Server Status module. This vulnerability allows low-privileged authenticated attackers to execute arbitrary commands by injecting unsanitized input, which is then stored and rendered unescaped in the application.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.