Ipfire - vulnerabilities (CVEs)

33 CVEs in 1 products, 0 in the last 30 days, newest from 2026-02-18.

Products

Ipfire - 33 CVEs

Newest CVEs of Ipfire

CVE-2019-25398 - CVSS 6.1 (medium), 2026-02-18: IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow attackers to inject malicious scripts…
CVE-2019-25400 - CVSS 5.4 (medium), 2026-02-18: IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject…
CVE-2019-25399 - CVSS 6.4 (medium), 2026-02-18: IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious…
CVE-2019-25397 - CVSS 6.1 (medium), 2026-02-18: IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious…
CVE-2019-25396 - CVSS 6.1 (medium), 2026-02-18: IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that allows attackers to inject malicious…
CVE-2025-34317 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34308 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34311 - CVSS 8.8 (high), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands…
CVE-2025-34314 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34310 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34313 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34316 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34309 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34312 - CVSS 8.8 (high), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands…
CVE-2025-34315 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34301 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34304 - CVSS 7.1 (high), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authenticated attacker to manipulate the SQL query used…
CVE-2025-34307 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34303 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34306 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34302 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
CVE-2025-34305 - CVSS 5.4 (medium), 2025-10-28: IPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabilities caused by a bug in the cleanhtml() function…
CVE-2025-50975 - CVSS 5.4 (medium), 2025-08-26: IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark,…
CVE-2025-50976 - CVSS 6.1 (medium), 2025-08-26: IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters,…
CVE-2025-50974 - CVSS 6.5 (medium), 2025-08-26: The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter…
CVE-2025-34116 - CVSS 8.7 (high), 2025-07-15: A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can…
CVE-2022-36368 - CVSS 4.8 (medium), 2022-10-24: Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with…
CVE-2020-19204 - CVSS 5.4 (medium), 2021-07-12: An authenticated Stored Cross-Site Scriptiong (XSS) vulnerability exists in Lightning Wire Labs IPFire 2.21 (x86_64) - Core Update 130 in the "routing.cgi"…
CVE-2020-21142 - CVSS 6.1 (medium), 2021-06-28: Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi.
CVE-2020-19202 - CVSS 5.4 (medium), 2021-06-17: An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TITLE" parameter in…