CVE-2019-25377

4.8 mediumEPSS 0.3%

Medium (4.8) in opnsense opnsense. EPSS 0.3% chance of exploitation in the next 30 days.

OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scripts via the value parameter. Attackers can craft POST requests with script payloads in the value parameter to execute JavaScript in the context of authenticated user sessions.

Severity

CVSS 4.0

4.8 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-02-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

opnsense:opnsense

References

https://forum.opnsense.org/index.php?topic=11469.0
https://opnsense.org
https://www.exploit-db.com/exploits/46351
https://www.vulncheck.com/advisories/opnsense-reflected-xss-via-systemadvancedsysctlphp

Check your stack JSON