PT-2026-8371 · Smoothwall · Smoothwall Express

Ozer Goker · Publicado 2026-02-16 · Atualizado 2026-02-20 · CVE-2019-25388

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smoothwall Express version 3.1-SP4-polar-x86 64-update9

Description Smoothwall Express version 3.1-SP4-polar-x86 64-update9 contains a reflected cross-site scripting issue that allows unauthenticated attackers to inject malicious scripts. This is achieved by submitting crafted input to the ''ipblock.cgi'' endpoint. Specifically, attackers can inject script tags through the SRC IP and COMMENT parameters in POST requests, leading to the execution of arbitrary JavaScript in users' browsers.

Recommendations Apply input validation and output encoding to the SRC IP and COMMENT parameters in the ''ipblock.cgi'' endpoint.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25388

Produtos afetados

Smoothwall Express

Referências · 7

• 🔥 https://exploit-db.com/exploits/46333 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25388 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-25388 · Aviso do Fabricante
• http://smoothwall.org · Nota
• https://t.me/cveNotify/152610 · Publicação no Telegram
• https://t.me/CVEtracker/44840 · Publicação no Telegram
• https://vulncheck.com/advisories/smoothwall-express-ipblockcgi-cross-site-scripting · Nota