custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality. https://nvd.nist.gov/vuln/detail/CVE-2017-17089
