CVE-2019-25396

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25396
IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that allows attackers to inject malicious scripts through POST parameters. Attackers can submit crafted requests with script payloads in the MAX_DISK_USAGE or MAX_DOWNLOAD_RATE parameters to execute arbitrary JavaScript in users' browsers.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso Product
https://www.exploit-db.com/exploits/46344 Exploit Third Party Advisory VDB Entry
https://www.ipfire.org Product
https://www.vulncheck.com/advisories/ipfire-core-update-reflected-xss-via-updatexlrator Broken Link Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ipfire:ipfire:2.21:core_update127:*:*:*:*:*:*
History

26 Feb 2026, 15:06

Type Values Removed Values Added
First Time Ipfire
Ipfire ipfire
Summary
  • (es) IPFire 2.21 Core Update 127 contiene una vulnerabilidad de cross-site scripting reflejada en el script updatexlrator.cgi que permite a los atacantes inyectar scripts maliciosos a través de parámetros POST. Los atacantes pueden enviar solicitudes manipuladas con cargas útiles de script en los parámetros MAX_DISK_USAGE o MAX_DOWNLOAD_RATE para ejecutar JavaScript arbitrario en los navegadores de los usuarios.
CPE cpe:2.3:a:ipfire:ipfire:2.21:core_update127:*:*:*:*:*:*
References () https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso - () https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso - Product
References () https://www.exploit-db.com/exploits/46344 - () https://www.exploit-db.com/exploits/46344 - Exploit, Third Party Advisory, VDB Entry
References () https://www.ipfire.org - () https://www.ipfire.org - Product
References () https://www.vulncheck.com/advisories/ipfire-core-update-reflected-xss-via-updatexlrator - () https://www.vulncheck.com/advisories/ipfire-core-update-reflected-xss-via-updatexlrator - Broken Link, Third Party Advisory

18 Feb 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-18 22:16

Updated : 2026-02-26 15:06

NVD link : CVE-2019-25396

Mitre link : CVE-2019-25396

CVE.ORG link : CVE-2019-25396

JSON object : View

Products Affected

ipfire

  • ipfire
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')