VULNERABILITY INTELLIGENCE

CVE-2019-25370

CVSS score6.1 MEDIUM
EPSS probability0.28%
CISA KEVNot currently listed
Published2026-02-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through multiple parameters. Attackers can send POST requests to interfaces_vlan_edit.php with script payloads in the tag, descr, or vlanif parameters to execute arbitrary JavaScript in users' browsers.

Weakness classification

  • disclosure@vulncheck.com: CWE-79

Primary references