彙總 endian 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 跨站腳本與路徑處理缺陷 等問題，部分漏洞可能導致 工作階段劫持，並影響 軟體部署與生產負載 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2026-34823 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/password/web/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34822 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the new_cert_name parameter to /manage/ca/certificate/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.09% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34821 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/vpnauthentication/user/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.16% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34820 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/ipsec/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34819 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the REMARK parameter to /cgi-bin/openvpnclient.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.18% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34818 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/localdomains/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34817 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34816 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the domain parameter to /manage/smtpscan/domainrouting/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34815 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the DOMAIN parameter to /cgi-bin/smtpdomains.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34814 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the group parameter to /cgi-bin/proxygroup.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34813 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the user parameter to /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.17% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34812 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the mimetypes parameter to /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34811 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/xtaccess.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34810 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34809 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34808 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.14% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34807 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/incoming.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.21% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34806 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/snat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.17% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34805 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/dnat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.17% | 2026-04-02 | 2026-06-17 |
| CVE-2026-34804 | Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the dscp parameter to /manage/qos/rules/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page. | [email protected] | 5.1 | 0.17% | 2026-04-02 | 2026-06-17 |