CVE-2026-27508
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Mar 30, 2026
Vendor
unknown
Description
Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitation of the url parameter. Attackers can craft malicious URLs with javascript: schemes that execute arbitrary JavaScript in victims' browsers when clicked through the unsanitized link.