PT-2026-8361 · Smoothwall · Smoothwall Express

Ozer Goker · Published 2026-02-16 · Updated 2026-02-16 · CVE-2019-25378

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smoothwall Express version 3.1-SP4-polar-x86 64-update9

Description The software contains multiple cross-site scripting issues within the proxy functionality. Attackers can inject malicious scripts through parameters in the ''proxy.cgi'' endpoint. Specifically, the CACHE SIZE, MAX SIZE, MIN SIZE, MAX OUTGOING SIZE, and MAX INCOMING SIZE parameters are susceptible to exploitation. Attackers can submit POST requests containing script payloads, which are then stored or reflected as JavaScript code, executing in users' browsers when the proxy configuration page is accessed.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25378

Affected Products

Smoothwall Express

References · 7

• 🔥 https://exploit-db.com/exploits/46333 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25378 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25378 · Security Note
• https://t.me/CVEtracker/44830 · Telegram Post
• http://smoothwall.org · Note
• https://vulncheck.com/advisories/smoothwall-express-proxycgi-cross-site-scripting · Note
• https://t.me/cveNotify/152126 · Telegram Post