CVE-2026-34818
MEDIUM
NVD
CVSS Score
6.4
Severity
MEDIUM
Published
Apr 02, 2026
Vendor
unknown
Description
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/localdomains/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.