CVE-2019-25397 MEDIUM

CVE-2019-25397: IPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgi

Vendor Ipfire
Product IPFire
Weakness CWE-79 · XSS
Published February 18, 2026
Last update May 24, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests with script payloads in the KEY1, IP, HOST, or DOM parameters to execute arbitrary JavaScript in users' browsers.

Key dates

02Disclosure timeline

February 18, 2026 CVE published
May 24, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-43997 WordPress easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg plugin <= 2.4.14 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-40656 Extension - plasma-web.ru - Reflected XSS in Quickform component for Joomla 1.0.0-3.3.01 CVE-2024-8921 Zita Elementor Site Library <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVE-2024-3614 SourceCodester Warehouse Management System customer.php cross site scripting CVE-2025-24027 ps_contactinfo has potential XSS due to usage of the nofilter tag in template