Vulnerability Details CVE-2026-26352
Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross-site scripting vulnerability in the /cgi-bin/vpnmain.cgi script due to improper sanitation of the VPN_IP parameter. Authenticated attackers can inject arbitrary JavaScript through VPN configuration settings that executes when the affected page is viewed by other users.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 8.2%
CVSS Severity
CVSS v3 Score 5.4
References
Products affected by CVE-2026-26352
-
cpe:2.3:o:smoothwall:smoothwall_express:3.0
-
cpe:2.3:o:smoothwall:smoothwall_express:3.1