CVE-2019-25369

OPNsense 19.1 Stored XSS via system_advanced_sysctl.php

Medium5.1Public exploitEPSS 0.24%

Published: 15 Feb 2026
Updated: 5 Mar 2026
Reserved: 15 Feb 2026
Assigned by: VulnCheck

Description

OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject persistent malicious scripts via the tunable parameter. Attackers can submit POST requests with script payloads that are stored and executed in the context of authenticated user sessions when the page is viewed.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-46351 (opens in a new tab)exploit

Timeline

2026
15 Feb 2026
15 Feb 2026
ID reserved
By VulnCheck
15 Feb 2026
15 Feb 2026
Published
5 Mar 202618 days later
5 Mar 2026· 18 days later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2019-25369, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
VulnCheckCNA (assigner)	3.1	Medium6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVDNVD · Analyzed	4.0	Medium5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.24% · top 85% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Weakness

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

Opnsense · OPNsense
- affected 19.1

What to do

Solution: OPNsense 19.1.1 released

References (4)

ExploitDB-46351 (opens in a new tab)exploit
OPNsense Official Website (opens in a new tab)product
OPNsense 19.1.1 Release Announcement (opens in a new tab)patch
VulnCheck Advisory: OPNsense 19.1 Stored XSS via system_advanced_sysctl.php (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2019-25369](https://trackcve.app/badge/CVE-2019-25369.svg)](https://trackcve.app/cve/CVE-2019-25369)

Record last updated 5 Mar 2026, 01:26 UTC.