CVE-2025-50975

IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark, src_addr, std_net_tgt, and tgt_addr, allowing an authenticated administrator to inject persistent JavaScript. This stored XSS payload is executed whenever another admin views the firewall rules page, enabling session hijacking, unauthorized actions within the interface, or further internal pivoting. Exploitation requires only high-privilege GUI access, and the complexity of the attack is low.

• CWE-79

• https://github.com/4rdr/proofs/blob/main/info/IPFire-2.29-Stored-XSS-via-Firewall.mdExploit, Third Party Advisory
• https://github.com/4rdr/proofs/blob/main/info/IPFire-2.29-Stored-XSS-via-Firewall.mdExploit, Third Party Advisory

Published

Aug 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-50952openjpeg v 2.5.0 was discovered to contain a NULL pointer de…6.5
• CVE-2025-5096The TablePress plugin for WordPress is vulnerable to DOM-Bas…5.4
• CVE-2025-5097Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-50971Directory traversal vulnerability in AbanteCart version 1.4.…7.5
• CVE-2025-50972SQL Injection vulnerability in AbanteCart 1.4.2, allows unau…9.8
• CVE-2025-50974The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.…6.5
• CVE-2025-50976IPFire 2.29 DNS management interface (dns.cgi) fails to prop…6.1
• CVE-2025-50977A template injection vulnerability leading to reflected cros…6.1
• CVE-2025-50978In Gitblit v1.7.1, a reflected cross-site scripting (XSS) vu…6.1
• CVE-2025-50979NodeBB v4.3.0 is vulnerable to SQL injection in its search-c…8.6
• CVE-2025-5098PrinterShare Android application allows the capture of Gmail…9.1
• CVE-2025-50983SQL Injection vulnerability exists in the sortKey parameter …8.3