CVE-2025-34318None▾ Sunlit

IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLS_HOSTNAME, UPSTREAM_USER, UPSTREAM_PASSWOR…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 28, 2025

Updated

Sep 26, 2026

CVSS

—

Vendor

—

Product

—

CWE

CWE-79

Depth score

3 · Minimal

EPSS

0.48% · p39

Platforms

—

Source

NVD

Vector

—

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 333 days

Oct 28, 2025Published
Disclosed via NVD
Sep 26, 2026Record revised
Last analysed / modified upstream
Sep 26, 2026EPSS first tracked
0.5%

CWE-79 #nvd

Full technical detail▾

Overview

IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLS_HOSTNAME, UPSTREAM_USER, UPSTREAM_PASSWORD, ADMIN_MAIL_ADDRESS, and ADMIN_PASSWORD parameters when adding a new DNS entry. When a user adds a DNS entry, the application issues an HTTP POST request to /cgi-bin/dns.cgi and these values are provided in the corresponding parameters. The values are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected DNS configuration.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed