What’s Vulnerable › Vulnerabilities

CVE-2019-25397: IPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgi

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-18 · updated 2026-06-17
• Weakness: CWE-79

Description

IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests with script payloads in the KEY1, IP, HOST, or DOM parameters to execute arbitrary JavaScript in users' browsers.

Affected products

• IPFire.org IPFire: 2.21-core_update127

References

• https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso
• https://www.exploit-db.com/exploits/46344
• https://www.ipfire.org
• https://www.vulncheck.com/advisories/ipfire-core-update-cross-site-scripting-via-hostsc

Get alerted when CVE-2019-25397 or the next vulnerability affects your stack