Skip to content
OpenAdvisories
Medium WID-SEC-2026-2635 2 CVEs

OPNsense: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Aug 3, 2026 · Updated Aug 3, 2026 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OPNsense ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

OPNsense ist eine freie Firewall-Distribution auf Basis von FreeBSD.

Vulnerabilities 2

  • Medium 5.4
    CVE-2026-49131

    OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field

    OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via th…

    Deciso OPNsense
  • Medium 5.4
    CVE-2026-49132

    OPNsense < 26.1.9 Stored XSS via Certificate Description Field

    OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized de…

    Deciso OPNsense

Revision history

  1. #1

    Initiale Fassung

References