webmin/webmin — pull request #22 by Neo139 (2011-10-17 15:55:21+00:00)
Title: Escape user-generated content.

before
http://i.imgur.com/CuLhN.png
after
http://i.imgur.com/iwv1O.png

A couple of things
thing 1)
There are no security risk at all in having this unescaped. Although if admin disable referer protection, there are plenty of CSRF, clickjacking and probably XSS out there. (this is not one of them)
So why fix this?
1-Aesthetics. e.g. if a user has as username, you will not see his name when deleting him.
2-To avoid generating non-sense like this:
https://mrmichaelwill.wordpress.com/2008/04/24/webmin-1410-insecurities-xss-exploit/

thing 2)
If its ok with you, I will submit small fixes to bugs like this, that some of them *maybe* could be exploited if referer protection is disabled.

thing 3)
By the way, currently Webmin is vuln to clickjacking (yes, with referer protection enabled). Good side, exploits are not easy to make. I will try to find an easy-to-implement solution when I have time. (If you don't know what clickjacking is (its 'new') check out Black Hat 2010 talk about it (pretty cool talk)