PT-2026-8240 · Nextcloud+1 · Nextcloud+1

Ozer Goker · CVE-2019-25368 · Publicado 2026-02-15 · Atualizado 2026-02-15

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPNsense version 19.1

Description The software contains multiple cross-site scripting issues in the /diag backup.php API endpoint. Attackers can inject malicious scripts through several parameters, including GDrive GDriveEmail, GDrive GDriveFolderID, GDrive GDriveBackupCount, Nextcloud url, Nextcloud user, Nextcloud password, Nextcloud password encryption, and Nextcloud backupdir. By submitting POST requests with script payloads in these parameters, attackers can execute arbitrary JavaScript within the context of authenticated administrator sessions.

Recommendations Apply a fix or update to a newer version that addresses this vulnerability. As a temporary workaround, consider restricting access to the /diag backup.php endpoint to minimize the risk of exploitation. Sanitize all input received through the GDrive GDriveEmail, GDrive GDriveFolderID, GDrive GDriveBackupCount, Nextcloud url, Nextcloud user, Nextcloud password, Nextcloud password encryption, and Nextcloud backupdir parameters.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25368

Produtos afetados

Nextcloud

Opnsense

Referências · 8

• 🔥 https://exploit-db.com/exploits/46351 · Exploit
• https://vulncheck.com/advisories/opnsense-reflected-xss-via-diagbackupphp · Nota
• https://t.me/CVEtracker/44762 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-25368 · Nota de Segurança
• https://t.me/cveNotify/152061 · Publicação no Telegram
• https://opnsense.org · Nota
• https://forum.opnsense.org/index.php?topic=11469.0 · Correção
• https://osv.dev/vulnerability/CVE-2019-25368 · Aviso do Fabricante