CVE-2026-26352— Smoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi via VPN_IP Parameter
Quick assessment
Affected
Smoothwall Express
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Smoothwall Express是Smoothwall开源的一个基于GNU/Linux的防火墙操作系统。 Smoothwall Express 3.1 Update 13之前版本存在跨站脚本漏洞，该漏洞源于对VPN_IP参数清理不当，可能导致存储型跨站脚本攻击。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Smoothwall | Express | < 3.1 Update 13 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-26352
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Smoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi via VPN_IP Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross-site scripting vulnerability in the /cgi-bin/vpnmain.cgi script due to improper sanitation of the VPN_IP parameter. Authenticated attackers can inject arbitrary JavaScript through VPN configuration settings that executes when the affected page is viewed by other users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Smoothwall Express 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Smoothwall Express是Smoothwall开源的一个基于GNU/Linux的防火墙操作系统。 Smoothwall Express 3.1 Update 13之前版本存在跨站脚本漏洞，该漏洞源于对VPN_IP参数清理不当，可能导致存储型跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Smoothwall | Express | 0 ~ 3.1 Update 13 | - |
|
II. Public POCs for CVE-2026-26352
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-26352
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Express
-
CVE-2026-27508
Smoothwall Express < 3.1 Update 13 Reflected XSS in redirect -
CVE-2024-10491
Preload arbitrary resources by injecting additional `Link` h -
CVE-2024-9266
Open Redirect -
CVE-2024-43796
express vulnerable to XSS via response.redirect() -
CVE-2024-29041
Express.js Open Redirect in malformed URLs
Same vendor: Smoothwall
-
CVE-2026-27508
Smoothwall Express < 3.1 Update 13 Reflected XSS in redirect -
CVE-2019-25395
Smoothwall Express 3.1 'preferences.cgi' Cross-Site Scriptin -
CVE-2019-25394
Smoothwall Express 3.1 'modem.cgi' Cross-Site Scripting -
CVE-2019-25393
Smoothwall Express 3.1 'smoothinfo.cgi' Cross-Site Scripting -
CVE-2019-25392
Smoothwall Express 3.1 'iptools.cgi' Cross-Site Scripting
Same weakness: CWE-79
-
CVE-2023-5648
Brocade ASCG v3.0以下版本HTTP头缺失漏洞 -
CVE-2026-94154
Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site -
CVE-2026-95595
WordPress Disable and Remove Google Fonts | GDPR & DSGVO fri -
CVE-2026-94670
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripti -
CVE-2026-94662
WordPress Unlimited Elements For Elementor plugin <= 2.0.19
V. Comments for CVE-2026-26352
No comments yet