Threats tagged 'ghsa-g7g3-vjgj-mw8w'

IPFire versions prior to 2.29 (Core Update 198) have a stored cross-site scripting (XSS) vulnerability. An authenticated attacker can inject arbitrary JavaScript via the txt_mailuser and txt_mailpass parameters when updating mail server settings. These parameters are stored and later rendered without proper sanitization, enabling script execution in other users' browsers viewing the mail configuration.