Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2019-25376

Good to know:

icon
icon

Date: February 15, 2026

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL parameter. Attackers can send POST requests to the proxy endpoint with JavaScript code in the ignoreLogACL parameter to execute arbitrary scripts in users' browsers.

Severity Score

Related Resources (6)

https://forum.opnsense.org/index.php?topic=11469.0
https://www.exploit-db.com/exploits/46351
https://www.vulncheck.com/advisories/opnsense-reflected-xss-via-proxy-endpoint
https://opnsense.org
https://nvd.nist.gov/vuln/detail/CVE-2019-25376
https://www.mend.io/vulnerability-database/CVE-2019-25376

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/opnsense/plugins.git - 19.1.1;https://github.com/opnsense/plugins.git - 19.7.d

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us