PT-2026-8361 · Smoothwall · Smoothwall Express

Ozer Goker · CVE-2019-25378 · Publicado 2026-02-16 · Atualizado 2026-02-16

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smoothwall Express version 3.1-SP4-polar-x86 64-update9

Description The software contains multiple cross-site scripting issues within the proxy functionality. Attackers can inject malicious scripts through parameters in the ''proxy.cgi'' endpoint. Specifically, the CACHE SIZE, MAX SIZE, MIN SIZE, MAX OUTGOING SIZE, and MAX INCOMING SIZE parameters are susceptible to exploitation. Attackers can submit POST requests containing script payloads, which are then stored or reflected as JavaScript code, executing in users' browsers when the proxy configuration page is accessed.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25378

Produtos afetados

Smoothwall Express

Referências · 7

• 🔥 https://exploit-db.com/exploits/46333 · Exploit
• https://t.me/CVEtracker/44830 · Publicação no Telegram
• http://smoothwall.org · Nota
• https://osv.dev/vulnerability/CVE-2019-25378 · Aviso do Fabricante
• https://vulncheck.com/advisories/smoothwall-express-proxycgi-cross-site-scripting · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25378 · Nota de Segurança
• https://t.me/cveNotify/152126 · Publicação no Telegram