Threats tagged 'ghsa-x346-frjj-7v85'

IPFire versions prior to 2.29 (Core Update 198) have a stored cross-site scripting (XSS) vulnerability. This flaw allows an authenticated attacker to inject arbitrary JavaScript code via the pienumber parameter when updating firewall country search defaults. The injected script executes in the context of other users who view these settings due to improper sanitization and encoding of the parameter value.