CVE-2026-115425

Published: Ott 26, 2026 Last Modified: Ott 26, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.

https://digitalcanion.com/security-research/#ghsa-9h93-hhcx…
https://digitalcanion.com/security-research/#ghsa-9h93-hhcx-957c
https://github.com/opnsense/core/security/advisories/GHSA-9…
https://github.com/opnsense/core/security/advisories/GHSA-9h93-hhcx-957c