CVE-2025-34318
published 2025-10-28CVE-2025-34318: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject…
PriorityP431medium5.1CVSS 4.0
AVNACLATNPRLUIPVCNVINVANSCLSILSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.48%
37.8th percentile
IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLS_HOSTNAME, UPSTREAM_USER, UPSTREAM_PASSWORD, ADMIN_MAIL_ADDRESS, and ADMIN_PASSWORD parameters when adding a new DNS entry. When a user adds a DNS entry, the application issues an HTTP POST request to /cgi-bin/dns.cgi and these values are provided in the corresponding parameters. The values are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected DNS configuration.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ipfire.org | ipfire | < 2.29 (Core Update 198) | 2.29 (Core Update 198) |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS IPFire proxy.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34318)
suricata·2025-10-30·CVSS 5.1
CVE-2025-34318 [MEDIUM] ET WEB_SPECIFIC_APPS IPFire proxy.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34318)
ET WEB_SPECIFIC_APPS IPFire proxy.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34318)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS IPFire proxy.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34318)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:18; content:"/cgi-bin/proxy.cgi"; fast_pattern; http.request_body; pcre:"/(?:UPSTREAM_(?:USER|PASSWORD)|ADMIN_(?:MAIL_ADDRESS|PASSWORD)|TLS_HOSTNAME)\x3d.*(?:on(?:(?:error)|(?:s(?:elec|ubmi)|rese)t|d(?:blclick|ragdrop)|(?:mouse|key)[a-z]|c(?:hange|lick)|(?:un)?load|focus|blur)|s(?:cript|tyle))(?:=|%3[dD])/i"; reference:url,bugzilla.ipfire.org/attachment.cgi?id=1663; reference:cve,2025-34318; classtype:web-application-attack; sid:2065612; rev:2; metadata:affected_p
No public exploits indexed.
No writeups or analysis indexed.
2025-10-28
Published