Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the interfaces.cgi script that allow attackers to inject malicious scripts through multiple parameters including GREEN_ADDRESS, GREEN_NETMASK, RED_DHCP_HOSTNAME, RED_ADDRESS, DNS1_OVERRIDE, DNS2_OVERRIDE, RED_MAC, RED_NETMASK, DEFAULT_GATEWAY, DNS1, and DNS2. Attackers can craft POST requests to interfaces.cgi with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.
References
| Link | Resource |
|---|---|
| http://www.smoothwall.org | Product |
| https://www.exploit-db.com/exploits/46333 | Exploit Third Party Advisory VDB Entry |
| https://www.vulncheck.com/advisories/smoothwall-express-interfacescgi-cross-site-script | Broken Link |
Configurations
History
20 Feb 2026, 16:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:smoothwall:smoothwall_express:3.1:sp4:*:*:-:*:*:* | |
| First Time |
Smoothwall smoothwall Express
Smoothwall |
|
| References | () http://www.smoothwall.org - Product | |
| References | () https://www.exploit-db.com/exploits/46333 - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.vulncheck.com/advisories/smoothwall-express-interfacescgi-cross-site-script - Broken Link |
18 Feb 2026, 17:52
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
16 Feb 2026, 18:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-16 18:19
Updated : 2026-02-20 16:31
NVD link : CVE-2019-25390
Mitre link : CVE-2019-25390
CVE.ORG link : CVE-2019-25390
JSON object : View
Products Affected
smoothwall
- smoothwall_express
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')