CVE-2019-25419

medium

Description

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the schedule endpoint. Attackers can submit POST requests with JavaScript payloads in the SCHNAME parameter to execute arbitrary code in administrators' browsers when the schedule page is accessed.

References

https://www.vulncheck.com/advisories/comodo-dome-firewall-stored-cross-site-scripting-via-schedule

https://www.exploit-db.com/exploits/46408

https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278

https://cdome.comodo.com/firewall/

Details

Source: Mitre, NVD

Published: 2026-02-19

Updated: 2026-02-19

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 7.2

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Severity: High

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Severity: Medium