PT-2026-8377 · Smoothwall · Smoothwall Express

Ozer Goker · Published 2026-02-16 · Updated 2026-02-16 · CVE-2019-25395

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Smoothwall Express version 3.1-SP4-polar-x86 64-update9

Description The software contains multiple stored cross-site scripting issues within the preferences.cgi script. Attackers can inject malicious scripts through the HOSTNAME, KEYMAP, and OPENNESS parameters. Exploitation involves submitting POST requests with script payloads to preferences.cgi, which stores malicious code that executes in the browsers of users accessing the preferences page.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25395

Affected Products

Smoothwall Express

References · 6

• 🔥 https://exploit-db.com/exploits/46333 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25395 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25395 · Vendor Advisory
• http://smoothwall.org · Note
• https://vulncheck.com/advisories/smoothwall-express-preferencescgi-cross-site-scrip · Note
• https://t.me/CVEtracker/44846 · Telegram Post