https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-25400.htmlhttps://patchthecve.com/cve/CVE-2019-25400.htmlWed, 17 Jun 2026 02:32:16 +0000MEDIUM 5.4: IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grp_name, remark, SRV_NAME, SRV_PORT, SRhttps://patchthecve.com/cve/CVE-2019-25399.htmlhttps://patchthecve.com/cve/CVE-2019-25399.htmlWed, 17 Jun 2026 02:32:15 +0000MEDIUM 6.4: IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute arbithttps://patchthecve.com/cve/CVE-2019-25398.htmlhttps://patchthecve.com/cve/CVE-2019-25398.htmlWed, 17 Jun 2026 02:32:15 +0000MEDIUM 6.1: IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow attackers to inject malicious scripts through VPN configuration parameters. Attackers can submit POST requests with script payloads in parameters like VPN_IP, DMTU, ccdname, ccdsuhttps://patchthecve.com/cve/CVE-2019-25397.htmlhttps://patchthecve.com/cve/CVE-2019-25397.htmlWed, 17 Jun 2026 02:32:15 +0000MEDIUM 6.1: IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests with script payloads in the KEY1, IP, HOST, or DOM parameters to exhttps://patchthecve.com/cve/CVE-2019-25396.htmlhttps://patchthecve.com/cve/CVE-2019-25396.htmlWed, 17 Jun 2026 02:32:15 +0000MEDIUM 6.1: IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that allows attackers to inject malicious scripts through POST parameters. Attackers can submit crafted requests with script payloads in the MAX_DISK_USAGE or MAX_DOWNLOAD_RATE paramethttps://patchthecve.com/cve/CVE-2025-34317.htmlhttps://patchthecve.com/cve/CVE-2025-34317.htmlWed, 17 Jun 2026 09:13:51 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLS_HOSTNAME parameter when adding a new DNS entry. When a user adds a DNS entry, the application issues an https://patchthecve.com/cve/CVE-2025-34316.htmlhttps://patchthecve.com/cve/CVE-2025-34316.htmlSat, 26 Sep 2026 00:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the txt_mailuser and txt_mailpass parameters when updating the mail server settings. When a user updates the maihttps://patchthecve.com/cve/CVE-2025-34315.htmlhttps://patchthecve.com/cve/CVE-2025-34315.htmlSat, 26 Sep 2026 00:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the REMOTELOG_ADDR parameter when updating the remote syslog server address. When a user updates the Remote logghttps://patchthecve.com/cve/CVE-2025-34314.htmlhttps://patchthecve.com/cve/CVE-2025-34314.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SRC, DST, and COMMENT parameters when creating a time constraint rule. When a user adds a time constraint ruhttps://patchthecve.com/cve/CVE-2025-34313.htmlhttps://patchthecve.com/cve/CVE-2025-34313.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the QUOTA_USERS parameter when creating a user quota rule. When a user adds a new user quota rule the applicatiohttps://patchthecve.com/cve/CVE-2025-34312.htmlhttps://patchthecve.com/cve/CVE-2025-34312.htmlSat, 26 Sep 2026 00:10:00 +0000HIGH 8.8: IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST https://patchthecve.com/cve/CVE-2025-34311.htmlhttps://patchthecve.com/cve/CVE-2025-34311.htmlSat, 26 Sep 2026 00:10:00 +0000HIGH 8.8: IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. When a user creates a Proxy report the application issues an HTTP Phttps://patchthecve.com/cve/CVE-2025-34310.htmlhttps://patchthecve.com/cve/CVE-2025-34310.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the INC_SPD, OUT_SPD, DEFCLASS_INC, and DEFCLASS_OUT parameters when updating Quality of Service (QoS) settings.https://patchthecve.com/cve/CVE-2025-34309.htmlhttps://patchthecve.com/cve/CVE-2025-34309.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SERVICE, LOGIN, and PASSWORD parameters when creating or editing a Dynamic DNS host. When a new Dynamic DNS https://patchthecve.com/cve/CVE-2025-34308.htmlhttps://patchthecve.com/cve/CVE-2025-34308.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the UPDATE_VALUE parameter when updating the default time synchronization settings. When the default values disphttps://patchthecve.com/cve/CVE-2025-34307.htmlhttps://patchthecve.com/cve/CVE-2025-34307.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the pienumber parameter when updating the firewall country search defaults. When a user updates the default valuhttps://patchthecve.com/cve/CVE-2025-34306.htmlhttps://patchthecve.com/cve/CVE-2025-34306.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the pienumber parameter when updating the default firewall IP search values. When a user updates these defaults,https://patchthecve.com/cve/CVE-2025-34305.htmlhttps://patchthecve.com/cve/CVE-2025-34305.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabilities caused by a bug in the cleanhtml() function (/var/ipfire/header.pl) that fails to apply HTML-entity encoding to user input. When an authenticated user submits data to affected endpointshttps://patchthecve.com/cve/CVE-2025-34304.htmlhttps://patchthecve.com/cve/CVE-2025-34304.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 6.5: IPFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authenticated attacker to manipulate the SQL query used when viewing OpenVPN connection logs via the CONNECTION_NAME parameter. When viewing a range of OpenVPN connection logs, the application issueshttps://patchthecve.com/cve/CVE-2025-34303.htmlhttps://patchthecve.com/cve/CVE-2025-34303.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the IGNORE_ENTRY_REMARK parameter when adding a whitelisted host. When a whitelisted host is added, an HTTP POSThttps://patchthecve.com/cve/CVE-2025-34302.htmlhttps://patchthecve.com/cve/CVE-2025-34302.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the PROT parameter when creating a new service. When a user adds a service, the application issues an HTTP POST https://patchthecve.com/cve/CVE-2025-34301.htmlhttps://patchthecve.com/cve/CVE-2025-34301.htmlMon, 19 Oct 2026 13:10:00 +0000MEDIUM 5.4: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code into the COUNTRY_CODE parameter when creating a location group. When a user adds a new location group, the application ihttps://patchthecve.com/cve/CVE-2025-50975.htmlhttps://patchthecve.com/cve/CVE-2025-50975.htmlWed, 17 Jun 2026 09:35:28 +0000MEDIUM 5.4: IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark, src_addr, std_net_tgt, and tgt_addr, allowing an authenticated administrator to inject persistent JavaScript. This stored XSS payload is exechttps://patchthecve.com/cve/CVE-2025-50976.htmlhttps://patchthecve.com/cve/CVE-2025-50976.htmlWed, 17 Jun 2026 09:35:28 +0000MEDIUM 6.1: IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.https://patchthecve.com/cve/CVE-2025-50974.htmlhttps://patchthecve.com/cve/CVE-2025-50974.htmlWed, 17 Jun 2026 09:35:28 +0000MEDIUM 6.5: The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter values into a shell command. An unauthenticated remote attacker can inject arbitrary OS commands by embedding shell metacharacters in any of t