CVE-2025-34308

IPFire 2.x before 2.29 (Core Update 198) has a stored XSS via the UPDATE_VALUE parameter when updating Time Server settings. An authenticated user can submit arbitrary JavaScript to /cgi-bin/time.cgi; the value is stored and later rendered in the web interface, allowing script execution in other ...