CVE-2019-25399
IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi
- State
- Published
- Severity
- 5.1 Medium
- Published
- Feb 18, 2026
- Updated
- Mar 5, 2026
- Reserved
- Feb 18, 2026
Description
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
IPFireIpfire |
|
References
- ExploitDB-46344exploit
- IPFire Official Websiteproduct
- IPFire 2.21 Core Update 127 Downloadpatch
- VulnCheck Advisory: IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgithird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.