CVE-2026-34813

Endian Firewall 3.3.25 and earlier are affected by a stored XSS vulnerability in the /cgi-bin/proxyuser.cgi user parameter. An authenticated attacker can inject JavaScript that is stored and executed when other users view the affected page.

CVE-2026-34813 Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the user parameter to /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...

CVE-2026-34811 Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the remark parameter to /cgi-bin/xtaccess.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...

CVE-2026-34811

The CVE concerns Endian Firewall (version 3.3.25 and earlier) where the remark parameter of /cgi-bin/xtaccess.cgi allows stored XSS. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. Public disclosures from NVD and CVE r...

CVE-2026-34812 Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the mimetypes parameter to /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...

CVE-2026-34812

Endian Firewall prior to 3.3.25 is affected by a stored XSS in the mimetypes parameter of /cgi-bin/proxypolicy.cgi. An authenticated user can inject JavaScript that is stored and executed when other users view the page. CVSS data from sources indicates a network-priority issue with low attack com...

CVE-2026-34810 Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the remark parameter to /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...

CVE-2026-34810 Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the remark parameter to /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...

CVE-2026-34810

Endian Firewall versions up to 3.3.25 are affected by a stored XSS in the remark parameter of /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. This is described across CVE-2026-34810 records (NVD, CV...

CVE-2026-34809 Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the remark parameter to /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...

CVE-2026-34809

Endian Firewall 3.3.25 and earlier are affected by a stored XSS in the remark parameter of /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored on the page and executed when other users view the affected page. Affected component: the CGI endpoint /cgi-bin/...

CVE-2026-34809 Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the remark parameter to /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...

CVE-2026-34808 Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the remark parameter to /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...

CVE-2026-34807 Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the remark parameter to /cgi-bin/incoming.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...

CVE-2026-34808 Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the remark parameter to /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...

CVE-2026-34808

Vulnerability summary (CVE-2026-34808) Endian Firewall

CVE-2026-34807

CVE-2026-34807 affects Endian Firewall up to version 3.3.25, where a vulnerability in the remark parameter of /cgi-bin/incoming.cgi enables stored XSS. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. The provided docum...

CVE-2026-34807 Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the remark parameter to /cgi-bin/incoming.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...

CVE-2026-34806

CVE-2026-34806 affects Endian Firewall versions 3.3.25 and earlier. The vulnerability arises from the remark parameter sent to /cgi-bin/snat.cgi, enabling an authenticated attacker to perform a stored cross-site scripting (XSS) attack by injecting arbitrary JavaScript that is later executed when ...

CVE-2026-34806 Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting XSS via the remark parameter to /cgi-bin/snat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page...