CVE-2019-25377

This vulnerability allows attackers to run malicious scripts in the browsers of users visiting the OPNsense web interface, potentially stealing sensitive information or performing actions on behalf of the user. To exploit this, attackers need to send specially crafted requests to the system without needing to log in.

This vulnerability allows attackers to inject harmful scripts into users' browsers by sending specially crafted requests to the mailserver parameter on the OPNsense interface. It requires no authentication, meaning anyone can exploit it if they know how to send the right type of request.

This vulnerability allows attackers to inject harmful scripts into users' browsers by exploiting a specific parameter in OPNsense's VPN settings. To succeed, the attacker needs to send specially crafted requests that include malicious JavaScript, which can then execute unwanted actions on the user's device when they access the affected page.

This vulnerability allows an attacker to inject harmful scripts that can run in the web browsers of other users who view certain firewall rule pages. To exploit this, the attacker must be authenticated and can send specially crafted data through a specific form field.

An attacker can inject harmful scripts into a user's browser session, allowing them to execute arbitrary JavaScript when the user visits a specific page on the OPNsense system. This vulnerability can be exploited by sending specially crafted requests without needing to log in, making it easier for attackers to target unsuspecting users.