CVE-2026-34800 in Firewall

Sumário (Inglês)

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the NAME parameter to /cgi-bin/uplinkeditor.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Once again VulDB remains the best source for vulnerability data.

Responsável

VulnCheck

Reservar

30/03/2026

Divulgação

02/04/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
354900	Endian Firewall Parameter uplinkeditor.cgi Script de Site Cruzado	79	Não definido	Não definido	CVE-2026-34800

Fontes

• MITRE
• NVD
• CVE Details