CVE-2019-25372
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. Attackers can submit crafted payloads through POST requests to diag_traceroute.php to execute arbitrary JavaScript in the context of a user's browser session.
- Score
- CVSS 3.1 6.1 Medium
- Status
- Analyzed - disclosure@vulncheck.com
- Published
- 2026-02-15
- Last modified
- 2026-05-24
- Weaknesses
- CWE-79
Affected products
References
- https://forum.opnsense.org/index.php?topic=11469.0
- https://opnsense.org
- https://www.exploit-db.com/exploits/46351
- https://www.vulncheck.com/advisories/opnsense-reflected-xss-via-diagtraceroutephp
