Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
Comodo Dome Firewall 2.7.0 allows attackers to inject malicious scripts in logins
CVE-2019-25402
Summary
An attacker can trick users into revealing sensitive information or taking unwanted actions by sending a special kind of link or form request to their browser. This can happen when a user navigates to a website that contains a malicious link or form that triggers this vulnerability. To fix this, update Comodo Dome Firewall to the latest version.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| comodo | dome_firewall | <= 2.7.0 | – |
Original title
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the username para...
Original description
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the username parameter. Attackers can send POST requests to the login endpoint with script payloads in the username field to execute arbitrary JavaScript in users' browsers.
nvd CVSS3.1
6.1
nvd CVSS4.0
5.1
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
- https://cdome.comodo.com/firewall/ Product
- https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9278&af=92... Not Applicable
- https://www.exploit-db.com/exploits/46408 Exploit Third Party Advisory
- https://www.vulncheck.com/advisories/comodo-dome-firewall-cross-site-scripting-v... Third Party Advisory
Published: 19 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026