CVE-2019-25397
IPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgi
- State
- Published
- Severity
- 5.1 Medium
- Published
- Feb 18, 2026
- Updated
- May 24, 2026
- Reserved
- Feb 18, 2026
Description
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests with script payloads in the KEY1, IP, HOST, or DOM parameters to execute arbitrary JavaScript in users' browsers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
IPFireIpfire |
|
References
- ExploitDB-46344exploit
- IPFire Official Websiteproduct
- IPFire 2.21 Core Update 127 Downloadpatch
- VulnCheck Advisory: IPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgithird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.