{"id":"CVE-2019-25407","state":"PUBLISHED","title":"Comodo Dome Firewall 2.7.0 Cross-Site Scripting via backupschedule","description":"Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the backup schedule interface. Attackers can send POST requests to the backupschedule endpoint with JavaScript code in the BACKUP_RCPTTO parameter to execute arbitrary scripts in users' browsers.","publishedAt":"2026-02-19T12:02:24.818Z","updatedAt":"2026-05-24T01:36:34.435Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Comodo Comodo Dome Firewall"],"affected":[{"vendor":"Comodo","product":"Comodo Dome Firewall","versions":[{"version":"2.7.0","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/46408","https://cdome.comodo.com/firewall/","https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278","https://www.vulncheck.com/advisories/comodo-dome-firewall-cross-site-scripting-via-backupschedule"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:45:53.332Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/25xxx/CVE-2019-25407.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2019-25407","state":"PUBLISHED","datePublished":"2026-02-19T12:02:24.818Z","dateUpdated":"2026-05-24T01:36:34.435Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-02-18T22:38:02.733Z"},"containers":{"cna":{"title":"Comodo Dome Firewall 2.7.0 Cross-Site Scripting via backupschedule","descriptions":[{"lang":"en","value":"Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the backup schedule interface. Attackers can send POST requests to the backupschedule endpoint with JavaScript code in the BACKUP_RCPTTO parameter to execute arbitrary scripts in users' browsers."}],"affected":[{"vendor":"Comodo","product":"Comodo Dome Firewall","versions":[{"version":"2.7.0","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/46408","name":"ExploitDB-46408","tags":["exploit"]},{"url":"https://cdome.comodo.com/firewall/","name":"Comodo Dome Firewall Official Homepage","tags":["product"]},{"url":"https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=9278","name":"Comodo Dome Firewall Purchase Page","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/comodo-dome-firewall-cross-site-scripting-via-backupschedule","name":"VulnCheck Advisory: Comodo Dome Firewall 2.7.0 Cross-Site Scripting via backupschedule","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-05-24T01:36:34.435Z"},"datePublic":"2019-02-18T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:comodo:comodo_dome_firewall:2.7.0:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Ozer Goker","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-19T19:03:23.279703Z","id":"CVE-2019-25407","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-19T19:03:41.949Z"}}]}}}