CVE-2019-25368: Opnsense

Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days.

OPNsense 19.1 contains multiple cross-site scripting vulnerabilities in the diag_backup.php endpoint that allow attackers to inject malicious scripts through multiple parameters including GDrive_GDriveEmail, GDrive_GDriveFolderID, GDrive_GDriveBackupCount, Nextcloud_url, Nextcloud_user, Nextcloud_password, Nextcloud_password_encryption, and Nextcloud_backupdir. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.

Affected products

• Opnsense Opnsense: version 19.1 only

Published 2026-02-15. Last modified 2026-06-17.