Smoothwall

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:smoothwall:smoothwall:3.1:*:*:*:*:*:*:*

part: a version: 3.1 update: *

VendorSmoothwall (865cb07c-b8ac-55da-ac2b-e5c438e361b3)
ProductSmoothwall (4998684e-1d9d-5ae2-aa26-a213ebe42f8c)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2019-25395 vulnerable 2026-06-08 05:13:42.322261 Smoothwall Express 3.1 'preferences.cgi' Cross-Site Scripting
HIGH (7.2)
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple stored cross-site scripting vulnerabilities in the preferences.cgi script that allow attackers to inject malicious scripts through the HOSTNAME, KEYMAP, and OPENNESS parameters. Attackers can submit POST requests with script payloads to preferences.cgi to store malicious code that executes in the browsers of users accessing the preferences page.
Published: 2026-02-16T17:05:07.943Z
Updated: 2026-03-05T01:26:37.679Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25394 vulnerable 2026-06-08 05:13:42.321886 Smoothwall Express 3.1 'modem.cgi' Cross-Site Scripting
HIGH (7.2)
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple stored cross-site scripting vulnerabilities in the modem.cgi script that allow attackers to inject malicious scripts through POST parameters. Attackers can submit crafted payloads in parameters like INIT, HANGUP, SPEAKER_ON, SPEAKER_OFF, TONE_DIAL, and PULSE_DIAL to execute arbitrary JavaScript in users' browsers when the stored data is retrieved.
Published: 2026-02-16T17:05:07.096Z
Updated: 2026-03-05T01:26:36.924Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25393 vulnerable 2026-06-08 05:13:42.321415 Smoothwall Express 3.1 'smoothinfo.cgi' Cross-Site Scripting
MEDIUM (6.1)
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation. Attackers can submit POST requests to the smoothinfo.cgi endpoint with script payloads in the WRAP or SECTIONTITLE parameters to execute arbitrary JavaScript in victim browsers.
Published: 2026-02-16T17:05:06.185Z
Updated: 2026-03-05T01:26:36.119Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25392 vulnerable 2026-06-08 05:13:42.320826 Smoothwall Express 3.1 'iptools.cgi' Cross-Site Scripting
MEDIUM (6.1)
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the IP parameter. Attackers can send POST requests to the iptools.cgi endpoint with script payloads in the IP parameter to execute arbitrary JavaScript in victim browsers.
Published: 2026-02-16T17:05:05.287Z
Updated: 2026-03-05T01:26:35.315Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25390 vulnerable 2026-06-08 05:13:42.315978 Smoothwall Express 3.1 'interfaces.cgi' Cross-Site Scripting
MEDIUM (5.4)
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the interfaces.cgi script that allow attackers to inject malicious scripts through multiple parameters including GREEN_ADDRESS, GREEN_NETMASK, RED_DHCP_HOSTNAME, RED_ADDRESS, DNS1_OVERRIDE, DNS2_OVERRIDE, RED_MAC, RED_NETMASK, DEFAULT_GATEWAY, DNS1, and DNS2. Attackers can craft POST requests to interfaces.cgi with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.
Published: 2026-02-16T17:05:04.134Z
Updated: 2026-03-05T01:26:34.186Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25389 vulnerable 2026-06-08 05:13:42.315618 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25388 vulnerable 2026-06-08 05:13:42.315273 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25387 vulnerable 2026-06-08 05:13:42.314732 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25386 vulnerable 2026-06-08 05:13:42.314385 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25385 vulnerable 2026-06-08 05:13:42.314022 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25384 vulnerable 2026-06-08 05:13:42.313595 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25383 vulnerable 2026-06-08 05:13:42.313247 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25382 vulnerable 2026-06-08 05:13:42.312887 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25381 vulnerable 2026-06-08 05:13:42.312506 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25380 vulnerable 2026-06-08 05:13:42.312041 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25379 vulnerable 2026-06-08 05:13:42.311475 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-25378 vulnerable 2026-06-08 05:13:42.310098 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.