PT-2026-8244 · Opnsense · Opnsense

Ozer Goker · Published 2026-02-15 · Updated 2026-02-15 · CVE-2019-25372

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPNsense version 19.1

Description The software contains a reflected cross-site scripting issue that allows unauthenticated attackers to inject malicious scripts. This is due to insufficient input validation in the host parameter. Attackers can submit crafted payloads through POST requests to the /diag traceroute.php API endpoint to execute arbitrary JavaScript in the context of a user's browser session. The vulnerable parameter is host.

Recommendations Apply input validation to the host parameter in the /diag traceroute.php API endpoint.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25372

Affected Products

Opnsense

References · 8

• 🔥 https://exploit-db.com/exploits/46351 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25372 · Security Note
• https://forum.opnsense.org/index.php?topic=11469.0 · Patch
• https://opnsense.org · Note
• https://t.me/cveNotify/152065 · Telegram Post
• https://vulncheck.com/advisories/opnsense-reflected-xss-via-diagtraceroutephp · Note
• https://t.me/CVEtracker/44766 · Telegram Post