CVE-2022-36368

Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an arbitrary script.

• CWE-79
• CWE-79

• https://blog.ipfire.org/post/ipfire-2-27-core-update-170-releasedRelease Notes, Vendor Advisory
• https://bugzilla.ipfire.org/show_bug.cgi?id=12925Issue Tracking, Vendor Advisory
• https://github.com/ipfire/ipfire-2.xProduct, Third Party Advisory
• https://jvn.jp/en/jp/JVN15411362/index.htmlThird Party Advisory
• https://blog.ipfire.org/post/ipfire-2-27-core-update-170-releasedRelease Notes, Vendor Advisory
• https://bugzilla.ipfire.org/show_bug.cgi?id=12925Issue Tracking, Vendor Advisory
• https://github.com/ipfire/ipfire-2.xProduct, Third Party Advisory
• https://jvn.jp/en/jp/JVN15411362/index.htmlThird Party Advisory

Published

Oct 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36362A vulnerability has been identified in LOGO! 12/24RCE (6ED10…7.5
• CVE-2022-36363A vulnerability has been identified in LOGO! 12/24RCE (6ED10…5.3
• CVE-2022-36364Apache Calcite Avatica JDBC driver creates HTTP client insta…8.8
• CVE-2022-36365Multiple Authenticated (contributor+) Stored Cross-Site Scri…5.4
• CVE-2022-36366Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-36367Incorrect default permissions in the Intel(R) Support Androi…4.4
• CVE-2022-36369Improper access control in some QATzip software maintained b…7.8
• CVE-2022-3637A vulnerability has been found in Linux Kernel and classifie…5.5
• CVE-2022-36370Improper authentication in BIOS firmware for some Intel(R) N…7.8
• CVE-2022-36372Improper buffer restrictions in some Intel(R) NUC BIOS firmw…6.7
• CVE-2022-36373Multiple Cross-Site Request Forgery (CSRF) vulnerabilities i…8.8
• CVE-2022-36374Improper access control in some Intel(R) Aptio* V UEFI Firmw…6.7