IPFire 2.21 Core Update 127
Approved changes feed: RSS · Atom
cpe:2.3:a:ipfire:ipfire:2.21:core_update127:*:*:*:*:*:*part: a version: 2.21 update: core_update127
| Vendor | Ipfire (e2f83692-c36e-5a58-a6b6-e28d1499a2b1) |
|---|---|
| Product | Ipfire (719f44be-66f2-5489-b411-6123050f77ca) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/ipfire/ipfire-2.x |
purl2cpe | 2026-06-01 10:14:49.912557 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-25400 |
vulnerable | 2026-06-08 05:13:42.328176 |
IPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgi
MEDIUM (5.4)
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grp_name, remark, SRV_NAME, SRV_PORT, SRVGRP_NAME, SRVGRP_REMARK, and updatesrvgrp. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated users' browsers.
Published: 2026-02-18T20:59:11.293Z
Updated: 2026-05-24T01:36:32.247Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25399 |
vulnerable | 2026-06-08 05:13:42.327807 |
IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi
MEDIUM (6.4)
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that allow attackers to inject malicious scripts through the FS, PATH, and UUID parameters. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.
Published: 2026-02-18T20:59:10.495Z
Updated: 2026-03-05T01:26:40.933Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25398 |
vulnerable | 2026-06-08 05:13:42.327438 |
IPFire 2.21 Core Update 127 Cross-Site Scripting via ovpnmain.cgi
MEDIUM (6.1)
IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow attackers to inject malicious scripts through VPN configuration parameters. Attackers can submit POST requests with script payloads in parameters like VPN_IP, DMTU, ccdname, ccdsubnet, DOVPN_SUBNET, DHCP_DOMAIN, DHCP_DNS, DHCP_WINS, ROUTES_PUSH, FRAGMENT, KEEPALIVE_1, and KEEPALIVE_2 to execute arbitrary JavaScript in administrator browsers.
Published: 2026-02-18T20:59:09.712Z
Updated: 2026-05-24T01:36:31.579Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25397 |
vulnerable | 2026-06-08 05:13:42.326952 |
IPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgi
MEDIUM (6.1)
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests with script payloads in the KEY1, IP, HOST, or DOM parameters to execute arbitrary JavaScript in users' browsers.
Published: 2026-02-18T20:59:08.864Z
Updated: 2026-05-24T01:36:30.867Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25396 |
vulnerable | 2026-06-08 05:13:42.326384 |
IPFire 2.21 Core Update 127 Reflected XSS via updatexlrator.cgi
MEDIUM (6.1)
IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that allows attackers to inject malicious scripts through POST parameters. Attackers can submit crafted requests with script payloads in the MAX_DISK_USAGE or MAX_DOWNLOAD_RATE parameters to execute arbitrary JavaScript in users' browsers.
Published: 2026-02-18T20:59:07.991Z
Updated: 2026-05-24T01:36:30.111Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.