PT-2026-8364 · Smoothwall · Smoothwall Express

Ozer Goker · Published 2026-02-16 · Updated 2026-02-20 · CVE-2019-25381

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smoothwall Express version 3.1-SP4-polar-x86 64-update9

Description The software contains multiple reflected cross-site scripting issues within the hosts.cgi script. Attackers can inject malicious scripts through unvalidated parameters. Specifically, attackers can send POST requests to the ''/hosts.cgi'' endpoint with script payloads in the IP, HOSTNAME, or COMMENT parameters, leading to the execution of arbitrary JavaScript in users' browsers.

Recommendations Apply input validation and sanitization to the IP, HOSTNAME, and COMMENT parameters in the hosts.cgi script.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25381

Affected Products

Smoothwall Express

References · 8

• 🔥 https://exploit-db.com/exploits/46333 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25381 · Security Note
• https://vulncheck.com/advisories/smoothwall-express-hostscgi-cross-site-scripting · Note
• https://t.me/cveNotify/152600 · Telegram Post
• https://t.me/cveNotify/152129 · Telegram Post
• https://t.me/CVEtracker/44833 · Telegram Post
• http://smoothwall.org · Note