CVE-2026-58394

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata before rendering each certificate descr value in the SSL Certificate selector. The...

CVE-2026-58394 OPNsense: Stored XSS in Administration Settings via Certificate Description

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata before rendering each certificate descr value in the SSL Certificate selector. The...

CVE-2026-58394

The OPNsense firewall and routing platform is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 26.1.11 . The vulnerability exists because src/www/system_advanced_admin.php fails to include the $a_cert array in the legacy_html_escape_form_data() function before rendering certif...

CVE-2026-58394 OPNsense: Stored XSS in Administration Settings via Certificate Description

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata before rendering each certificate descr value in the SSL Certificate selector. The...

CVE-2023-39002

A cross-site scripting XSS vulnerability in the act parameter of systemcertmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

PT-2023-26728 · Opnsense · Opnsense Community Edition +1

Name of the Vulnerable Software and Affected Versions: OPNsense Community Edition versions prior to 23.7 OPNsense Business Edition versions prior to 23.4.2 Description: A cross-site scripting XSS issue exists in the act parameter of system certmanager.php, allowing attackers to execute arbitrary...

Deciso OPNsense Cross-Site Scripting Vulnerability

Deciso OPNsense is a FreeBSD-based open source firewall and routing software from the Dutch company Deciso. A cross-site scripting vulnerability exists in OPNsense versions prior to 23.7, which stems from a cross-site scripting XSS vulnerability in the act parameter of the systemcertmanager.php...