CVE-2019-25374 - OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php

Back Back to CVE browser

MEDIUM

OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php

Published Feb 15, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.34%

Description

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks parameter in vpn_ipsec_settings.php. Attackers can craft POST requests with JavaScript payloads in the passthrough_networks parameter to execute arbitrary code in users' browsers.

Affected products

Vendor Opnsense Product OPNsense Default
n/a
- Version
  19.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Opnsense

OPNsense

n/a

Version	Status	Constraints
19.1	affected	-

Remediation

Vendor solution

OPNsense 19.1.1 released

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://forum.opnsense.org/index.php?topic=11469.0
patchRelease Notes
https://opnsense.org
product
https://www.exploit-db.com/exploits/46351
exploitThird Party AdvisoryVDB Entry
https://www.vulncheck.com/advisories/opnsense-reflected-xss-via-vpnipsecsettingsphp
third-party-advisoryBroken Link

Link	Providers	Tags
https://forum.opnsense.org/index.php?topic=11469.0		patchRelease Notes
https://opnsense.org		product
https://www.exploit-db.com/exploits/46351		exploitThird Party AdvisoryVDB Entry
https://www.vulncheck.com/advisories/opnsense-reflected-xss-via-vpnipsecsettingsphp		third-party-advisoryBroken Link