PT-2026-8247 · Deciso · Opnsense

Ozer Goker · Published 2026-02-15 · Updated 2026-02-15 · CVE-2019-25375

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPNsense version 19.1

Description OPNsense version 19.1 is susceptible to a reflected cross-site scripting issue. Unauthenticated attackers can inject malicious scripts by providing crafted input to the mailserver parameter. Attackers can send POST requests to the /monit interface with JavaScript payloads in the mailserver parameter, potentially leading to arbitrary code execution in users' browsers. The affected API endpoint is /monit. The vulnerable parameter is mailserver.

Recommendations Apply input validation and output encoding to the mailserver parameter in the /monit interface.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25375

Affected Products

Opnsense

References · 7

• 🔥 https://exploit-db.com/exploits/46351 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25375 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25375 · Vendor Advisory
• https://forum.opnsense.org/index.php?topic=11469.0 · Patch
• https://vulncheck.com/advisories/opnsense-reflected-xss-via-monit-interface · Note
• https://t.me/CVEtracker/44769 · Telegram Post
• https://opnsense.org · Note