CVE-2019-25395

HIGH

7.2

Beschreibung

Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple stored cross-site scripting vulnerabilities in the preferences.cgi script that allow attackers to inject malicious scripts through the HOSTNAME, KEYMAP, and OPENNESS parameters. Attackers can submit POST requests with script payloads to preferences.cgi to store malicious code that executes in the browsers of users accessing the preferences page.

CVE Details

CVSS v3.1 Bewertung7.2

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht2/16/2026

Zuletzt geandert2/20/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

smoothwall:smoothwall_express

Schwachen (CWE)

CWE-79

Referenzen

http://www.smoothwall.org(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/46333(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/smoothwall-express-preferencescgi-cross-site-scrip(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.