Smoothwall Express 3.1 Service Pack 4

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:o:smoothwall:smoothwall_express:3.1:sp4:*:*:-:*:*:*

part: o version: 3.1 update: sp4

VendorSmoothwall (865cb07c-b8ac-55da-ac2b-e5c438e361b3)
ProductSmoothwall Express (c7546c54-8ad2-5be7-be04-d84c4b8b7b59)
Edition*
Language*
Software edition-
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:sourceforge/smoothwall purl2cpe 2026-07-28 16:41:13.429450

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2019-25395 vulnerable 2026-06-08 05:13:42.322282 Smoothwall Express 3.1 'preferences.cgi' Cross-Site Scripting
HIGH (7.2)
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple stored cross-site scripting vulnerabilities in the preferences.cgi script that allow attackers to inject malicious scripts through the HOSTNAME, KEYMAP, and OPENNESS parameters. Attackers can submit POST requests with script payloads to preferences.cgi to store malicious code that executes in the browsers of users accessing the preferences page.
Published: 2026-02-16T17:05:07.943Z
Updated: 2026-03-05T01:26:37.679Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25394 vulnerable 2026-06-08 05:13:42.321908 Smoothwall Express 3.1 'modem.cgi' Cross-Site Scripting
HIGH (7.2)
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple stored cross-site scripting vulnerabilities in the modem.cgi script that allow attackers to inject malicious scripts through POST parameters. Attackers can submit crafted payloads in parameters like INIT, HANGUP, SPEAKER_ON, SPEAKER_OFF, TONE_DIAL, and PULSE_DIAL to execute arbitrary JavaScript in users' browsers when the stored data is retrieved.
Published: 2026-02-16T17:05:07.096Z
Updated: 2026-03-05T01:26:36.924Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25393 vulnerable 2026-06-08 05:13:42.321439 Smoothwall Express 3.1 'smoothinfo.cgi' Cross-Site Scripting
MEDIUM (6.1)
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation. Attackers can submit POST requests to the smoothinfo.cgi endpoint with script payloads in the WRAP or SECTIONTITLE parameters to execute arbitrary JavaScript in victim browsers.
Published: 2026-02-16T17:05:06.185Z
Updated: 2026-03-05T01:26:36.119Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25392 vulnerable 2026-06-08 05:13:42.320856 Smoothwall Express 3.1 'iptools.cgi' Cross-Site Scripting
MEDIUM (6.1)
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the IP parameter. Attackers can send POST requests to the iptools.cgi endpoint with script payloads in the IP parameter to execute arbitrary JavaScript in victim browsers.
Published: 2026-02-16T17:05:05.287Z
Updated: 2026-03-05T01:26:35.315Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25390 vulnerable 2026-06-08 05:13:42.316003 Smoothwall Express 3.1 'interfaces.cgi' Cross-Site Scripting
MEDIUM (5.4)
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the interfaces.cgi script that allow attackers to inject malicious scripts through multiple parameters including GREEN_ADDRESS, GREEN_NETMASK, RED_DHCP_HOSTNAME, RED_ADDRESS, DNS1_OVERRIDE, DNS2_OVERRIDE, RED_MAC, RED_NETMASK, DEFAULT_GATEWAY, DNS1, and DNS2. Attackers can craft POST requests to interfaces.cgi with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.
Published: 2026-02-16T17:05:04.134Z
Updated: 2026-03-05T01:26:34.186Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25389 vulnerable 2026-06-08 05:13:42.315639 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25388 vulnerable 2026-06-08 05:13:42.315297 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25387 vulnerable 2026-06-08 05:13:42.314849 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25386 vulnerable 2026-06-08 05:13:42.314409 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25385 vulnerable 2026-06-08 05:13:42.314044 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25384 vulnerable 2026-06-08 05:13:42.313618 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25383 vulnerable 2026-06-08 05:13:42.313269 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25382 vulnerable 2026-06-08 05:13:42.312911 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25381 vulnerable 2026-06-08 05:13:42.312529 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25380 vulnerable 2026-06-08 05:13:42.312144 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25379 vulnerable 2026-06-08 05:13:42.311499 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25378 vulnerable 2026-06-08 05:13:42.310999 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.