PT-2026-20498 · Ipfire · Ipfire

Ozer Goker · Published 2026-02-18 · Updated 2026-02-18 · CVE-2019-25396

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IPFire version 2.21 Core Update 127

Description The software contains a reflected cross-site scripting flaw in the updatexlrator.cgi script. Attackers can inject malicious scripts through POST parameters. Specifically, crafted requests with script payloads in the MAX DISK USAGE or MAX DOWNLOAD RATE parameters can lead to the execution of arbitrary JavaScript in users' browsers. The affected API endpoint is updatexlrator.cgi. The vulnerable parameters are MAX DISK USAGE and MAX DOWNLOAD RATE.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25396

Affected Products

Ipfire

References · 6

• 🔥 https://exploit-db.com/exploits/46344 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25396 · Vendor Advisory
• https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-25396 · Security Note
• https://vulncheck.com/advisories/ipfire-core-update-reflected-xss-via-updatexlrator · Note
• https://ipfire.org · Note