PT-2026-8248 · Opnsense · Opnsense

Ozer Goker · Published 2026-02-15 · Updated 2026-02-15 · CVE-2019-25376

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPNsense version 19.1

Description OPNsense version 19.1 contains a reflected cross-site scripting issue that allows unauthenticated attackers to inject malicious scripts. Attackers can submit crafted payloads through the ignoreLogACL parameter to execute arbitrary scripts in users' browsers. This is achieved by sending POST requests to the proxy endpoint with JavaScript code in the ignoreLogACL parameter. The vulnerable API endpoint is '/proxy'.

Recommendations Apply a fix to address the reflected cross-site scripting issue in the ignoreLogACL parameter of the proxy endpoint.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25376

Affected Products

Opnsense

References · 7

• 🔥 https://exploit-db.com/exploits/46351 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25376 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25376 · Security Note
• https://forum.opnsense.org/index.php?topic=11469.0 · Patch
• https://vulncheck.com/advisories/opnsense-reflected-xss-via-proxy-endpoint · Note
• https://t.me/CVEtracker/44770 · Telegram Post
• https://opnsense.org · Note