CVE-2019-25404 - Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admins

Back Back to CVE browser

MEDIUM

Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admins

Published Feb 19, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.31%

Description

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input through admin management parameters. Attackers can inject script payloads in the admin_name, name, and surname parameters via POST requests to the /korugan/admins endpoint, which are stored and executed when administrators access the interface.

Affected products

Vendor Comodo Product Comodo Dome Firewall Default
n/a
- Version
  2.7.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Comodo

Comodo Dome Firewall

n/a

Version	Status	Constraints
2.7.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://cdome.comodo.com/firewall/
product
https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278
productNot Applicable
https://www.exploit-db.com/exploits/46408
exploitThird Party Advisory
https://www.vulncheck.com/advisories/comodo-dome-firewall-stored-cross-site-scripting-via-admins
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://cdome.comodo.com/firewall/		product
https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278		productNot Applicable
https://www.exploit-db.com/exploits/46408		exploitThird Party Advisory
https://www.vulncheck.com/advisories/comodo-dome-firewall-stored-cross-site-scripting-via-admins		third-party-advisoryThird Party Advisory