CVE-2019-25375: OPNsense 19.1 Reflected XSS via monit interface

Published Feb 15, 2026

Updated

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the mailserver parameter. Attackers can send POST requests to the monit interface with JavaScript payloads in the mailserver parameter to execute arbitrary code in users' browsers.

Affected Software

2 affected components

OPNsense OPNsense

OPNsense OPNsense=19.1

Remediation

Information

OPNsense 19.1.1 released

Event History

Feb 15, 2026

CVE Published

via MITRE·01:58 PM

Data Sourced

via MITRE·01:58 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Dec 7, 58362

Event

via NVD·12:21 AM

Frequently Asked Questions

What is the severity of CVE-2019-25375?

CVE-2019-25375 has a moderate severity rating due to its potential for reflected cross-site scripting attacks.

How do I fix CVE-2019-25375?

To fix CVE-2019-25375, update OPNsense to the latest version that addresses this vulnerability.

Who is affected by CVE-2019-25375?

Users of OPNsense version 19.1 are affected by CVE-2019-25375.

What type of vulnerability is CVE-2019-25375?

CVE-2019-25375 is a reflected cross-site scripting (XSS) vulnerability.

Can CVE-2019-25375 be exploited remotely?

Yes, CVE-2019-25375 can be exploited remotely by sending crafted requests to the monit interface.