CVE-2025-34302
- Published: 1761664570
- Last modified: 1761664570
CVE-2025-34302 — IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the PROT parameter when creating a new service. When a user adds a service, the application issues an HTTP POST request with the ACTION…
Related CVE by CWE
No related CWE found.
Top CVE for Vendor
No vendor taxonomy on this entry.
Recently Exploited Similar Vulnerabilities
No recent KEV-listed items for this vendor/product.
IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the PROT parameter when creating a new service. When a user adds a service, the application issues an HTTP POST request with the ACTION parameter set to saveservice, and the protocol type is specified in the PROT parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitization or encoding, allowing injected scripts to execute in the context of other users viewing the affected service entry.
🧠 Explainer: What this vulnerability means
Summary: the product from the vendor is impacted (CWE: unspecified).
Impact: Attackers could gain unauthorized access, execute code, or disrupt services.
Mitigation: Until patched, restrict exposure, enforce least privilege, and monitor for suspicious activity.
No vendor/product data yet.
No explicit mitigation/advisory links found in references.