CVE-2025-50976: Ipfire

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.

Affected products

• Ipfire Ipfire: version 2.29 only

Published 2025-08-26. Last modified 2026-06-17.