CVE-2025-50976

Description

IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.

PUBLISHED Reserved 2025-06-16 | Published 2025-08-26 | Updated 2025-08-27 | Assigner mitre

References

github.com/...main/info/IPFire-2.29-Reflected-XSS-via-DNS.md

cve.org (CVE-2025-50976)

nvd.nist.gov (CVE-2025-50976)

Download JSON