EUVD-2025-36519

IPFire versions prior to 2.29 Core Update 198 contain multiple stored cross-site scripting XSS vulnerabilities caused by a bug in the cleanhtml function /var/ipfire/header.pl that fails to apply HTML-entity encoding to user input. When an authenticated user submits data to affected endpoints - fo...

CVE-2025-34305

IPFire versions prior to 2.29 Core Update 198 contain multiple stored cross-site scripting XSS vulnerabilities caused by a bug in the cleanhtml function /var/ipfire/header.pl that fails to apply HTML-entity encoding to user input. When an authenticated user submits data to affected endpoints - fo...

CVE-2025-34305

IPFire before 2.29 (Core Update 198) contains multiple stored XSS flaws in the cleanhtml() function at /var/ipfire/header.pl. The bug prevents sanitized input from being written back to the output, so authenticated users submitting data to endpoints such as POST /cgi-bin/wakeonlan.cgi (CLIENT_COM...