CVE-2026-123622
MEDIUM
NVD
CVSS Score
6.1
Severity
MEDIUM
Published
Nov 06, 2026
Vendor
unknown
Description
Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment containing script and lure recipients to a detach.cgi link with type=text/html to run script in the victim's authenticated Usermin session.