Critical Webmin Vulnerabilities Allow Attackers to Impersonate as Any User

*Executive summary:* Multiple critical vulnerabilities in Webmin (pre-2.641) — including stored XSS enabling script execution as root, privilege escalation through the Help feature, mail-module XSS and unsafe attachment handling, and 2FA bypass via HTTP Basic Authentication — can be chained to achieve full system compromise; administrators are advised to upgrade immediately, disable unnecessary modules, enforce strict access controls, and disable Basic Auth where possible.