IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker inject arbitrary JavaScript code through the txt_mailuser and txt_mailpass parameters when updating mail server settings. When a user updates server, application issues HTTP POST request /cgi-bin/mail.cgi username password are provided in parameters. The values of these later rendered web interface without proper sanitation or encoding, allowing injected scripts execute context other users who view affected configuration.