Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
OPNsense 19.1 allows attackers to inject malicious scripts via user input
CVE-2019-25377
Summary
OPNsense firewall software has a security weakness that allows hackers to inject malicious code into the system using a specific user input field. This could allow a hacker to access sensitive information or take control of a user's account. Users should update to a patched version of OPNsense as soon as possible.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| opnsense | opnsense | 19.1 | – |
Original title
OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scripts via the value parameter. Attackers...
Original description
OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scripts via the value parameter. Attackers can craft POST requests with script payloads in the value parameter to execute JavaScript in the context of authenticated user sessions.
nvd CVSS3.1
6.1
nvd CVSS4.0
4.8
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
- https://forum.opnsense.org/index.php?topic=11469.0 Release Notes
- https://opnsense.org Product
- https://www.exploit-db.com/exploits/46351 Exploit Third Party Advisory VDB Entry
- https://www.vulncheck.com/advisories/opnsense-reflected-xss-via-systemadvancedsy... Broken Link
Published: 15 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026