Ipfire / Ipfire
32 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2019-25400 | IPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgi | MEDIUM | 4.8 | Feb 18, 2026 |
| CVE-2019-25399 | IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi | MEDIUM | 5.1 | Feb 18, 2026 |
| CVE-2019-25398 | IPFire 2.21 Core Update 127 Cross-Site Scripting via ovpnmain.cgi | MEDIUM | 5.1 | Feb 18, 2026 |
| CVE-2019-25397 | IPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgi | MEDIUM | 5.1 | Feb 18, 2026 |
| CVE-2019-25396 | IPFire 2.21 Core Update 127 Reflected XSS via updatexlrator.cgi | MEDIUM | 5.1 | Feb 18, 2026 |
| CVE-2025-34311 | IPFire < v2.29 Command Injection via Proxy Report Creation | HIGH | 8.7 | Oct 28, 2025 |
| CVE-2025-34312 | IPFire < v2.29 Command Injection via URL Filter Blacklist | HIGH | 8.7 | Oct 28, 2025 |
| CVE-2025-34304 | IPFire < v2.29 SQL Injection via OpenVPN Connection Logs | HIGH | 7.1 | Oct 28, 2025 |
| CVE-2025-34307 | IPFire < v2.29 Stored XSS via Default Country Search | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34306 | IPFire < v2.29 Stored XSS via Default IP Search Value | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34308 | IPFire < v2.29 Stored XSS via Default Time Sync | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34317 | IPFire < v2.29 Stored XSS via DNS Creation (dns.cgi) | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34309 | IPFire < v2.29 Stored XSS via Dynamic DNS Host | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34301 | IPFire < v2.29 Stored XSS via Location Group Creation | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34316 | IPFire < v2.29 Stored XSS via Mail Server Settings | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34305 | IPFire < v2.29 Stored XSS via Multiple Methods in cleanhtml() | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34310 | IPFire < v2.29 Stored XSS via Quality of Service (QoS) Settings | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34315 | IPFire < v2.29 Stored XSS via Remote Syslog Server Address | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34302 | IPFire < v2.29 Stored XSS via Service Creation | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34314 | IPFire < v2.29 Stored XSS via Time Constraint Rule URL Filter | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34313 | IPFire < v2.29 Stored XSS via User Quota Rule URL Filter | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-34303 | IPFire < v2.29 Stored XSS via Whitelisted Host Creation | MEDIUM | 5.1 | Oct 28, 2025 |
| CVE-2025-50976 | IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, res… | MEDIUM | 6.1 | Aug 26, 2025 |
| CVE-2025-50975 | IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark,… | MEDIUM | 5.4 | Aug 26, 2025 |
| CVE-2025-50974 | The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter v… | MEDIUM | 6.5 | Aug 26, 2025 |
Showing 1 to 25 of 32 CVEs