Ipfire vulnerabilities

Products

• Ipfire 32

Newest

• ipfire IPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgi CVE-2019-25400 4.8 MediumFebruary 18, 2026
• ipfire IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi CVE-2019-25399 5.1 MediumFebruary 18, 2026
• ipfire IPFire 2.21 Core Update 127 Cross-Site Scripting via ovpnmain.cgi CVE-2019-25398 5.1 MediumFebruary 18, 2026
• ipfire IPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgi CVE-2019-25397 5.1 MediumFebruary 18, 2026
• ipfire IPFire 2.21 Core Update 127 Reflected XSS via updatexlrator.cgi CVE-2019-25396 5.1 MediumFebruary 18, 2026
• ipfire IPFire < v2.29 Command Injection via Proxy Report Creation CVE-2025-34311 EPSS 13.5% 8.7 HighOctober 28, 2025
• ipfire IPFire < v2.29 Command Injection via URL Filter Blacklist CVE-2025-34312 8.7 HighOctober 28, 2025
• ipfire IPFire < v2.29 SQL Injection via OpenVPN Connection Logs CVE-2025-34304 7.1 HighOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Default Country Search CVE-2025-34307 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Default IP Search Value CVE-2025-34306 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Default Time Sync CVE-2025-34308 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via DNS Creation (dns.cgi) CVE-2025-34317 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Dynamic DNS Host CVE-2025-34309 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Location Group Creation CVE-2025-34301 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Mail Server Settings CVE-2025-34316 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Multiple Methods in cleanhtml() CVE-2025-34305 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Quality of Service (QoS) Settings CVE-2025-34310 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Remote Syslog Server Address CVE-2025-34315 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Service Creation CVE-2025-34302 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Time Constraint Rule URL Filter CVE-2025-34314 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via User Quota Rule URL Filter CVE-2025-34313 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Whitelisted Host Creation CVE-2025-34303 5.1 MediumOctober 28, 2025
• ipfire IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in... CVE-2025-50976 6.1 MediumAugust 26, 2025
• ipfire IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters... CVE-2025-50975 5.4 MediumAugust 26, 2025
• ipfire The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly... CVE-2025-50974 6.5 MediumAugust 26, 2025
• ipfire Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions... CVE-2022-36368 4.8 MediumOctober 24, 2022
• ipfire Lightning Wire Labs IPFire 2.21 (x86_64) - Core Update 130 is affected by: Cross Site Scripting ... CVE-2020-19204 5.4 MediumJuly 12, 2021
• ipfire Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi. CVE-2020-21142 6.1 MediumJune 28, 2021
• ipfire An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via... CVE-2020-19202 5.4 MediumJune 17, 2021
• ipfire lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned... CVE-2021-33393 Public exploit EPSS 59.3% 8.8 HighJune 9, 2021
• ipfire An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core... CVE-2018-16232 8.8 HighOctober 17, 2018
• ipfire IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter,... CVE-2017-9757 Public exploit EPSS 37.4% 8.8 HighJune 19, 2017