PT-2026-8240 · Nextcloud+1 · Nextcloud+1

Ozer Goker · Published 2026-02-15 · Updated 2026-02-15 · CVE-2019-25368

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPNsense version 19.1

Description The software contains multiple cross-site scripting issues in the /diag backup.php API endpoint. Attackers can inject malicious scripts through several parameters, including GDrive GDriveEmail, GDrive GDriveFolderID, GDrive GDriveBackupCount, Nextcloud url, Nextcloud user, Nextcloud password, Nextcloud password encryption, and Nextcloud backupdir. By submitting POST requests with script payloads in these parameters, attackers can execute arbitrary JavaScript within the context of authenticated administrator sessions.

Recommendations Apply a fix or update to a newer version that addresses this vulnerability. As a temporary workaround, consider restricting access to the /diag backup.php endpoint to minimize the risk of exploitation. Sanitize all input received through the GDrive GDriveEmail, GDrive GDriveFolderID, GDrive GDriveBackupCount, Nextcloud url, Nextcloud user, Nextcloud password, Nextcloud password encryption, and Nextcloud backupdir parameters.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25368

Affected Products

Nextcloud

Opnsense

References · 8

• 🔥 https://exploit-db.com/exploits/46351 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25368 · Security Note
• https://forum.opnsense.org/index.php?topic=11469.0 · Patch
• https://osv.dev/vulnerability/CVE-2019-25368 · Vendor Advisory
• https://vulncheck.com/advisories/opnsense-reflected-xss-via-diagbackupphp · Note
• https://t.me/CVEtracker/44762 · Telegram Post
• https://t.me/cveNotify/152061 · Telegram Post
• https://opnsense.org · Note