Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 35

Export CSV
CVE-2026-34805

Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/dnat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34817

Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34812

Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the mimetypes parameter to /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34811

Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/xtaccess.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34790

Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal

Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in the remove ARCHIVE parameter to /cgi-bin/backup.cgi. The remove ARCHIVE parameter value is used to construct a file path without sanitization of directory traversal sequences, which is then passed to an unlink() call.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Endian Endian Firewall
Products
Firewall Firewall Community Endian Firewall
CVE-2026-34791

Endian Firewall /cgi-bin/logs_proxy.cgi DATE Perl Command Injection

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_proxy.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.

CVSS 4.0 · 8.7 High EPSS 1.3% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34792

Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injection

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_clamav.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.

CVSS 4.0 · 8.7 High EPSS 1.3% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34793

Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_firewall.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.

CVSS 4.0 · 8.7 High EPSS 1.3% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34794

Endian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command Injection

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_ids.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34795

Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_log.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.

CVSS 4.0 · 8.7 High EPSS 1.5% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34796

Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injection

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.

CVSS 4.0 · 8.7 High EPSS 1.5% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34797

Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injection

Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_smtp.cgi. The DATE parameter value is used to construct a file path that is passed to a Perl open() call, which allows command injection due to an incomplete regular expression validation.

CVSS 4.0 · 8.7 High EPSS 1.3% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34798

Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34799

Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/hosts/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34800

Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the NAME parameter to /cgi-bin/uplinkeditor.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34801

Endian Firewall /manage/dhcp/fixed_leases/ remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dhcp/fixed_leases/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34802

Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark user ham spam parameter to /cgi-bin/salearn.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34803

Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the name parameter to /manage/qos/classes/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34804

Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the dscp parameter to /manage/qos/rules/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community
CVE-2026-34806

Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/snat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Endian
Products
Firewall Firewall Community