CVE-2019-25430 - Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via vpn_users

Back Back to CVE browser

MEDIUM

Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via vpn_users

Published Feb 19, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.38%

Description

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the username parameter. Attackers can send POST requests to the vpn_users endpoint with script payloads in the username field to execute arbitrary JavaScript in victim browsers.

Affected products

Vendor Comodo Product Comodo Dome Firewall Default
n/a
- Version
  2.7.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Comodo

Comodo Dome Firewall

n/a

Version	Status	Constraints
2.7.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://cdome.comodo.com/firewall/
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19640
Advisory
https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278
productNot Applicable
https://www.exploit-db.com/exploits/46408
exploitThird Party Advisory
https://www.vulncheck.com/advisories/comodo-dome-firewall-reflected-cross-site-scripting-via-vpnusers
third-party-advisoryBroken Link

Link	Providers	Tags
https://cdome.comodo.com/firewall/		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19640		Advisory
https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278		productNot Applicable
https://www.exploit-db.com/exploits/46408		exploitThird Party Advisory
https://www.vulncheck.com/advisories/comodo-dome-firewall-reflected-cross-site-scripting-via-vpnusers		third-party-advisoryBroken Link