Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the apcupsd.cgi script that allow attackers to inject malicious scripts through multiple POST parameters. Attackers can submit crafted POST requests with script payloads in parameters like BATTLEVEL, RTMIN, BATTDELAY, TO, ANNOY, UPSIP, UPSNAME, UPSPORT, POLLTIME, UPSUSER, NISPORT, UPSAUTH, EMAIL, FROM, CC, SMSEMAIL, SMTPSERVER, PORT, USER, and EMAIL_PASSWORD to execute arbitrary JavaScript in victim browsers.
References
| Link | Resource |
|---|---|
| http://www.smoothwall.org | Product |
| https://www.exploit-db.com/exploits/46333 | Exploit Third Party Advisory VDB Entry |
| https://www.vulncheck.com/advisories/smoothwall-express-apcupsdcgi-cross-site-scripting | Broken Link |
Configurations
History
20 Feb 2026, 16:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:smoothwall:smoothwall_express:3.1:sp4:*:*:-:*:*:* | |
| First Time |
Smoothwall smoothwall Express
Smoothwall |
|
| References | () http://www.smoothwall.org - Product | |
| References | () https://www.exploit-db.com/exploits/46333 - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.vulncheck.com/advisories/smoothwall-express-apcupsdcgi-cross-site-scripting - Broken Link |
18 Feb 2026, 17:52
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
16 Feb 2026, 18:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-16 18:19
Updated : 2026-02-20 16:26
NVD link : CVE-2019-25383
Mitre link : CVE-2019-25383
CVE.ORG link : CVE-2019-25383
JSON object : View
Products Affected
smoothwall
- smoothwall_express
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')