CVE-2022-36368: Ipfire

Medium severity, CVSS 4.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an arbitrary script.

Affected products

• Ipfire Ipfire: before 2.27 (fixed in 2.27); version 2.27 only

Published 2022-10-24. Last modified 2026-06-17.