CVE-2026-34823 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/password/web/. An authenticated attacker c… |
CVE-2026-34822 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the new_cert_name parameter to /manage/ca/certificate/. An authenticated a… |
CVE-2026-34821 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/vpnauthentication/user/. An authenticated… |
CVE-2026-34820 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/ipsec/. An authenticated attacker can inje… |
CVE-2026-34819 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the REMARK parameter to /cgi-bin/openvpnclient.cgi. An authenticated attac… |
CVE-2026-34818 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/localdomains/. An authenticated at… |
CVE-2026-34817 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi. An authenticated at… |
CVE-2026-34816 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the domain parameter to /manage/smtpscan/domainrouting/. An authenticated… |
CVE-2026-34815 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the DOMAIN parameter to /cgi-bin/smtpdomains.cgi. An authenticated attacke… |
CVE-2026-34814 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the group parameter to /cgi-bin/proxygroup.cgi. An authenticated attacker… |
CVE-2026-34813 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the user parameter to /cgi-bin/proxyuser.cgi. An authenticated attacker ca… |
CVE-2026-34812 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the mimetypes parameter to /cgi-bin/proxypolicy.cgi. An authenticated atta… |
CVE-2026-34811 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/xtaccess.cgi. An authenticated attacker c… |
CVE-2026-34810 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/vpnfw.cgi. An authenticated attacker can… |
CVE-2026-34809 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/zonefw.cgi. An authenticated attacker can… |
CVE-2026-34808 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/outgoingfw.cgi. An authenticated attacker… |
CVE-2026-34807 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/incoming.cgi. An authenticated attacker c… |
CVE-2026-34806 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/snat.cgi. An authenticated attacker can i… |
CVE-2026-34805 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/dnat.cgi. An authenticated attacker can i… |
CVE-2026-34804 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the dscp parameter to /manage/qos/rules/. An authenticated attacker can in… |
CVE-2026-34803 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the name parameter to /manage/qos/classes/. An authenticated attacker can… |
CVE-2026-34802 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark user ham spam parameter to /cgi-bin/salearn.cgi. An authenticat… |
CVE-2026-34801 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dhcp/fixed_leases/. An authenticated attac… |
CVE-2026-34800 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the NAME parameter to /cgi-bin/uplinkeditor.cgi. An authenticated attacker… |
CVE-2026-34799 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/hosts/. An authenticated attacker… |
CVE-2026-34798 | Medium | 6.4 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/routing.cgi. An authenticated attacker ca… |
CVE-2026-34797 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_smtp.cgi. The DATE… |
CVE-2026-34796 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_openvpn.cgi. The DA… |
CVE-2026-34795 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_log.cgi. The DATE p… |
CVE-2026-34794 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_ids.cgi. The DATE p… |
CVE-2026-34793 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_firewall.cgi. The D… |
CVE-2026-34792 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_clamav.cgi. The DAT… |
CVE-2026-34791 | High | 8.8 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to execute arbitrary OS commands via the DATE parameter to /cgi-bin/logs_proxy.cgi. The DATE… |
CVE-2026-34790 | High | 7.1 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via directory traversal in the remove ARCHIVE parameter to /cgi-bi… |
CVE-2021-27201 | High | 8.8 | 2021-02-15 | Endian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment. |
CVE-2012-4923 | | | 2012-09-15 | Multiple cross-site scripting (XSS) vulnerabilities in Endian Firewall 2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) createrule… |
CVE-2008-0494 | | | 2008-01-30 | Cross-site scripting (XSS) vulnerability in vpnum/userslist.php in Endian Firewall 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the… |