CVE-2019-25376 MEDIUM

CVE-2019-25376: OPNsense 19.1 Reflected XSS via proxy endpoint

Vendor Opnsense

Product OPNsense

Weakness CWE-79 · XSS

Published February 15, 2026

Last update May 24, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL parameter. Attackers can send POST requests to the proxy endpoint with JavaScript code in the ignoreLogACL parameter to execute arbitrary scripts in users' browsers.

Key dates

02Disclosure timeline

February 15, 2026 CVE published

May 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-25376 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-36179 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2024-37160 Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata CVE-2025-60040 WordPress wp-mpdf Plugin <= 3.9.1 - Cross Site Scripting (XSS) Vulnerability CVE-2024-32080 WordPress Search Keyword Redirect plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-1536 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar