CVE-2026-34811

The CVE concerns Endian Firewall (version 3.3.25 and earlier) where the remark parameter of /cgi-bin/xtaccess.cgi allows stored XSS. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. Public disclosures from NVD and CVE r...