CVE-2026-34803
MEDIUM
NVD
CVSS Score
6.4
Severity
MEDIUM
Published
Apr 02, 2026
Vendor
unknown
Description
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the name parameter to /manage/qos/classes/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.