Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

36 records

Vendor: opnsense Component: Opnsense Clear all filters
TI-2026-32173 CVE-2026-44194

OPNsense: RCE on user managment

Priority HIGH 74

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.05673 Published 2026-05-13 Fixed in 26.1.8 CWE-78
TI-2026-32174 CVE-2026-44195

OPNsense: Authentication lockout bypass

Priority HIGH 68

OPNsense is a FreeBSD based firewall and routing platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00318 Published 2026-05-13 Fixed in 26.1.7 CWE-307
TI-2019-15430 CVE-2019-25377 · GHSA-hp2h-w474-f9g4

OPNsense 19.1 Reflected XSS via system_advanced_sysctl.php

Priority MEDIUM 55

OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scripts via the value parameter.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.0028 Published 2026-02-15 No fix listed CWE-79
TI-2019-15429 CVE-2019-25376 · GHSA-2444-5vx9-4q2f

OPNsense 19.1 Reflected XSS via proxy endpoint

Priority MEDIUM 62

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0042 Published 2026-02-15 No fix listed CWE-79
TI-2019-15428 CVE-2019-25375 · GHSA-6333-cc9f-9589

OPNsense 19.1 Reflected XSS via monit interface

Priority MEDIUM 62

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the mailserver parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00416 Published 2026-02-15 No fix listed CWE-79
TI-2019-15427 CVE-2019-25374 · GHSA-prpr-jj7j-2v2f

OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php

Priority MEDIUM 62

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks parameter in vpn_ipsec_settings.php.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00368 Published 2026-02-15 No fix listed CWE-79
TI-2019-15426 CVE-2019-25373 · GHSA-xq5r-rwpv-6jwc

OPNsense 19.1 Stored XSS via firewall_rules_edit.php

Priority MEDIUM 56

OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the category parameter.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00238 Published 2026-02-15 No fix listed CWE-79
TI-2019-15425 CVE-2019-25372 · GHSA-8v3q-9fpq-83mr

OPNsense 19.1 Reflected XSS via diag_traceroute.php

Priority MEDIUM 56

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00287 Published 2026-02-15 No fix listed CWE-79
TI-2019-15424 CVE-2019-25371 · GHSA-6rfq-gmm4-49p9

OPNsense 19.1 Reflected XSS via diag_ping.php

Priority MEDIUM 56

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00287 Published 2026-02-15 No fix listed CWE-79
TI-2019-15423 CVE-2019-25370 · GHSA-58cm-5853-qxj5

OPNsense 19.1 Reflected XSS via interfaces_vlan_edit.php

Priority MEDIUM 56

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through multiple parameters.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00277 Published 2026-02-15 No fix listed CWE-79
TI-2019-15422 CVE-2019-25369 · GHSA-mh66-gfv9-x2xc

OPNsense 19.1 Stored XSS via system_advanced_sysctl.php

Priority MEDIUM 56

OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject persistent malicious scripts via the tunable parameter.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00238 Published 2026-02-15 No fix listed CWE-79
TI-2019-15421 CVE-2019-25368 · GHSA-48j5-wgv3-9c7p

OPNsense 19.1 Reflected XSS via diag_backup.php

Priority MEDIUM 55

OPNsense 19.1 contains multiple cross-site scripting vulnerabilities in the diag_backup.php endpoint that allow attackers to inject malicious scripts through multiple parameters including GDrive_GDriveEmail, GDrive_GDriv…

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00151 Published 2026-02-15 No fix listed CWE-79
TI-2025-32291 CVE-2025-50989 · GHSA-qf7f-cgq3-xfvh

OS command injection in OPNsense

Priority HIGH 74

OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php).

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.1093 Published 2025-08-27 Fixed in 25.1.8 CWE-78
TI-2023-20243 CVE-2023-39004 · GHSA-g5mw-r3hw-p72x

Insecure permissions in the configuration directory (/conf/) of OPNsense Community…

Priority HIGH 82

Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00986 Published 2023-08-09 No fix listed CWE-732
Load more