PT-2026-8249 · Opnsense · Opnsense

Ozer Goker · Published 2026-02-15 · Updated 2026-02-15 · CVE-2019-25377

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPNsense version 19.1

Description OPNsense 19.1 contains a reflected cross-site scripting issue in the /system advanced sysctl.php API endpoint. Attackers can inject malicious scripts through the value parameter. By crafting POST requests with script payloads in the value parameter, attackers can execute JavaScript within the context of authenticated user sessions.

Recommendations Apply a fix to address the reflected cross-site scripting issue in the /system advanced sysctl.php endpoint.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25377

Affected Products

Opnsense

References · 7

• 🔥 https://exploit-db.com/exploits/46351 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25377 · Vendor Advisory
• https://forum.opnsense.org/index.php?topic=11469.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-25377 · Security Note
• https://t.me/CVEtracker/44771 · Telegram Post
• https://opnsense.org · Note
• https://vulncheck.com/advisories/opnsense-reflected-xss-via-systemadvancedsysctlphp · Note