CVE-2026-34817
MEDIUM
NVD
CVSS Score
6.4
Severity
MEDIUM
Published
Apr 02, 2026
Vendor
unknown
Description
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.