CVE-2019-25403 MEDIUM

CVE-2019-25403: Comodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admin_profiles

Vendor Comodo
Product Comodo Dome Firewall
Weakness CWE-79 · XSS
Published February 19, 2026
Last update March 2, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the comment parameter. Attackers can inject JavaScript code through the admin_profiles endpoint that executes in the browsers of other users who view the affected page.

Key dates

02Disclosure timeline

February 19, 2026 CVE published
March 2, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-41236 WordPress Happy Elementor Addons Pro Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS) CVE-2026-6672 Affiliate Program Suite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode CVE-2017-12272 CVE-2024-33645 WordPress Easy Set Favicon plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-23452 WordPress EditionGuard for WooCommerce plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability