CVE-2019-25376

This vulnerability allows attackers to run malicious JavaScript in the web browser of users who are logged into the OPNsense system, potentially stealing their session cookies or other sensitive information. It requires the attacker to send specially crafted requests to a specific part of the system while the user is authenticated.

This vulnerability allows attackers to inject harmful scripts into users' browsers by sending specially crafted requests to the mailserver parameter on the OPNsense interface. It requires no authentication, meaning anyone can exploit it if they know how to send the right type of request.

This vulnerability allows attackers to inject harmful scripts into users' browsers by exploiting a specific parameter in OPNsense's VPN settings. To succeed, the attacker needs to send specially crafted requests that include malicious JavaScript, which can then execute unwanted actions on the user's device when they access the affected page.

This vulnerability allows an attacker to inject harmful scripts that can run in the web browsers of other users who view certain firewall rule pages. To exploit this, the attacker must be authenticated and can send specially crafted data through a specific form field.

An attacker can inject harmful scripts into a user's browser session, allowing them to execute arbitrary JavaScript when the user visits a specific page on the OPNsense system. This vulnerability can be exploited by sending specially crafted requests without needing to log in, making it easier for attackers to target unsuspecting users.