CVE-2026-34823 MEDIUM

CVE-2026-34823: Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting

Vendor Endian

Product Endian Firewall

Weakness CWE-79 · XSS

Published April 2, 2026

Last update April 2, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/password/web/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Key dates

02Disclosure timeline

April 2, 2026 CVE published

April 2, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-34823 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-47786 Emlog vulnerable to Stored Cross-site Scripting CVE-2024-2680 Campcodes Online Job Finder System index.php cross site scripting CVE-2022-2189 WP Video Lightbox < 1.9.5 - Reflected Cross-Site Scripting CVE-2025-22631 WordPress Marketing Automation Plugin <= 1.2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-2955 AI Chatbot & Workflow Automation by AIWU <= 1.4.14 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Header