PT-2026-20498 · Ipfire · Ipfire

Ozer Goker · CVE-2019-25396 · Publicado 2026-02-18 · Atualizado 2026-02-18

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IPFire version 2.21 Core Update 127

Description The software contains a reflected cross-site scripting flaw in the updatexlrator.cgi script. Attackers can inject malicious scripts through POST parameters. Specifically, crafted requests with script payloads in the MAX DISK USAGE or MAX DOWNLOAD RATE parameters can lead to the execution of arbitrary JavaScript in users' browsers. The affected API endpoint is updatexlrator.cgi. The vulnerable parameters are MAX DISK USAGE and MAX DOWNLOAD RATE.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25396

Produtos afetados

Ipfire

Referências · 6

• 🔥 https://exploit-db.com/exploits/46344 · Exploit
• https://vulncheck.com/advisories/ipfire-core-update-reflected-xss-via-updatexlrator · Nota
• https://osv.dev/vulnerability/CVE-2019-25396 · Aviso do Fabricante
• https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-25396 · Nota de Segurança
• https://ipfire.org · Nota