CVE-2019-25373

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25373
OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the category parameter. Attackers can send POST requests to firewall_rules_edit.php with script payloads in the category field to execute arbitrary JavaScript in the browsers of other users accessing firewall rule pages.

6.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://forum.opnsense.org/index.php?topic=11469.0 Release Notes
https://opnsense.org Product
https://www.exploit-db.com/exploits/46351 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/opnsense-stored-xss-via-firewallruleseditphp Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:opnsense:opnsense:19.1:*:*:*:*:*:*:*
History

18 Feb 2026, 19:13

Type Values Removed Values Added
References () https://forum.opnsense.org/index.php?topic=11469.0 - () https://forum.opnsense.org/index.php?topic=11469.0 - Release Notes
References () https://opnsense.org - () https://opnsense.org - Product
References () https://www.exploit-db.com/exploits/46351 - () https://www.exploit-db.com/exploits/46351 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/opnsense-stored-xss-via-firewallruleseditphp - () https://www.vulncheck.com/advisories/opnsense-stored-xss-via-firewallruleseditphp - Broken Link
First Time Opnsense opnsense
Opnsense
CPE cpe:2.3:a:opnsense:opnsense:19.1:*:*:*:*:*:*:*

18 Feb 2026, 17:52

Type Values Removed Values Added
Summary
  • (es) OPNsense 19.1 contiene una vulnerabilidad de cross-site scripting almacenado que permite a atacantes autenticados inyectar scripts maliciosos al enviar una entrada manipulada al parámetro de categoría. Los atacantes pueden enviar solicitudes POST a firewall_rules_edit.php con cargas útiles de script en el campo de categoría para ejecutar JavaScript arbitrario en los navegadores de otros usuarios que acceden a las páginas de reglas de cortafuegos.

15 Feb 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-15 14:16

Updated : 2026-02-18 19:13

NVD link : CVE-2019-25373

Mitre link : CVE-2019-25373

CVE.ORG link : CVE-2019-25373

JSON object : View

Products Affected

opnsense

  • opnsense
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')