Opnsense Firewall
Monthly
Stored and reflected cross-site scripting in OPNsense Firewall 26.7.1_1 and earlier lets an authenticated low-privileged GUI user execute JavaScript in another user's browser, including a root user's session, when the victim views the Dashboard, Interfaces → Overview, or submits a crafted Firewall → Log Files → Live View search. The stored variant requires write access to the Interfaces → Assignments Description field, while the reflected variant requires the victim to interact with the Live View search; both require valid GUI credentials and victim interaction. The issue is rated CVSS 5.6, no KEV status was provided, and a public PoC reference exists but is not verified as working exploit code.
Stored and reflected cross-site scripting in OPNsense Firewall 26.7.1_1 and earlier lets an authenticated low-privileged GUI user execute JavaScript in another user's browser, including a root user's session, when the victim views the Dashboard, Interfaces → Overview, or submits a crafted Firewall → Log Files → Live View search. The stored variant requires write access to the Interfaces → Assignments Description field, while the reflected variant requires the victim to interact with the Live View search; both require valid GUI credentials and victim interaction. The issue is rated CVSS 5.6, no KEV status was provided, and a public PoC reference exists but is not verified as working exploit code.