What is CVE-2019-25369?

CVE-2019-25369 is a medium-severity vulnerability in Opnsense, classified under Cross-site Scripting. CVSS score: 6.4/10. Published 2026-02-15.

How severe is CVE-2019-25369?

Medium severity. CVSS v3 base score is 6.4 out of 10.

XSS in Opnsense

CVE-2019-25369

OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject persistent malicious scripts via the tunable parameter. Attackers can submit POST requests with script payloads that are stored and executed in the context of authenticated user sessions when the page is viewed.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (10.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.

Affected products

Opnsense — versions 19.1

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

disclosure@vulncheck.com (Exploit, VDB Entry, Third Party Advisory, exploit)
disclosure@vulncheck.com (Product, product)
disclosure@vulncheck.com (Release Notes, patch)
disclosure@vulncheck.com (Broken Link, third-party-advisory)

Frequently asked questions

What is CVE-2019-25369?: CVE-2019-25369 is a medium-severity vulnerability in Opnsense, classified under Cross-site Scripting. CVSS score: 6.4/10. Published 2026-02-15.
How severe is CVE-2019-25369?: Medium severity. CVSS v3 base score is 6.4 out of 10.