medium6.4

CVE-2026-34802

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark user ham spam parameter to /cgi-bin/salearn.cgi.

Impact

Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark user ham spam parameter to /cgi-bin/salearn.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Affected products

Vendor	Product	Affected versions
Endian	Firewall Community	through 3.3.25

Weakness classification

CWE-79

References

NVD record
CVE.org record
https://help.endian.com/hc/en-us/sections/360004371358-Community
https://www.vulncheck.com/advisories/endian-firewall-cgi-bin-salearn-cgi-remark-user-ham-spam-stored-cross-site-scripting