Ipfire Project vulnerabilities

Products

• Ipfire 25

Newest

• ipfire IPFire 2.21 Core Update 127 Multiple XSS via fwhosts.cgi CVE-2019-25400 4.8 MediumFebruary 18, 2026
• ipfire IPFire 2.21 Core Update 127 Stored XSS via extrahd.cgi CVE-2019-25399 5.1 MediumFebruary 18, 2026
• ipfire IPFire 2.21 Core Update 127 Cross-Site Scripting via ovpnmain.cgi CVE-2019-25398 5.1 MediumFebruary 18, 2026
• ipfire IPFire 2.21 Core Update 127 Cross-Site Scripting via hosts.cgi CVE-2019-25397 5.1 MediumFebruary 18, 2026
• ipfire IPFire 2.21 Core Update 127 Reflected XSS via updatexlrator.cgi CVE-2019-25396 5.1 MediumFebruary 18, 2026
• ipfire IPFire < v2.29 Command Injection via Proxy Report Creation CVE-2025-34311 EPSS 13.5% 8.7 HighOctober 28, 2025
• ipfire IPFire < v2.29 Command Injection via URL Filter Blacklist CVE-2025-34312 8.7 HighOctober 28, 2025
• ipfire IPFire < v2.29 SQL Injection via OpenVPN Connection Logs CVE-2025-34304 7.1 HighOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Default Country Search CVE-2025-34307 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Default IP Search Value CVE-2025-34306 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Default Time Sync CVE-2025-34308 5.1 MediumOctober 28, 2025
• ipfire project ipfire IPFire < v2.29 Stored XSS via DNS Creation (proxy.cgi) CVE-2025-34318 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via DNS Creation (dns.cgi) CVE-2025-34317 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Dynamic DNS Host CVE-2025-34309 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Location Group Creation CVE-2025-34301 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Mail Server Settings CVE-2025-34316 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Multiple Methods in cleanhtml() CVE-2025-34305 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Quality of Service (QoS) Settings CVE-2025-34310 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Remote Syslog Server Address CVE-2025-34315 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Service Creation CVE-2025-34302 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Time Constraint Rule URL Filter CVE-2025-34314 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via User Quota Rule URL Filter CVE-2025-34313 5.1 MediumOctober 28, 2025
• ipfire IPFire < v2.29 Stored XSS via Whitelisted Host Creation CVE-2025-34303 5.1 MediumOctober 28, 2025
• ipfire project ipfire IPFire < 2.19 Core Update 101 proxy.cgi RCE CVE-2025-34116 Public exploit 8.7 HighJuly 15, 2025
• ipfire Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions... CVE-2022-36368 4.8 MediumOctober 24, 2022