Skip to content
Noroxi

opnsense records

36 published records for vendor opnsense.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
9
With a fix record
16.7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 21
  3. 23
  4. 25
  5. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

36 records
  • CVE-2023-39001
    40Plan

    A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.

    CriticalCVSS 9.8No exploitEPSS 3%

    opnsense · opnsenseAug 9, 2023

  • CVE-2023-39008
    40Plan

    A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition

    CriticalCVSS 9.8No exploitEPSS 3%

    opnsense · opnsenseAug 9, 2023

  • CVE-2025-50989
    39Monitor

    OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_ed

    CriticalCVSS 9.1No exploitEPSS 10%

    opnsense · opnsenseAug 27, 2025

  • CVE-2023-39007
    39Monitor

    /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAct

    CriticalCVSS 9.6Proof of conceptEPSS 2%

    opnsense · opnsenseAug 9, 2023

  • CVE-2023-27152
    39Monitor

    DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentica

    CriticalCVSS 9.8No exploitEPSS 1%

    opnsense · opnsenseOct 23, 2023

  • CVE-2023-39004
    39Monitor

    Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 al

    CriticalCVSS 9.8No exploitEPSS 0%

    opnsense · opnsenseAug 9, 2023

  • CVE-2026-44194
    38Monitor

    OPNsense: RCE on user managment

    CriticalCVSS 9.1No exploitEPSS 5%

    opnsense · opnsenseMay 13, 2026

  • CVE-2026-44193
    36Monitor

    OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method

    CriticalCVSS 9.1No exploitEPSS 0%

    opnsense · opnsenseMay 13, 2026

  • CVE-2026-45158
    36Monitor

    OPNsense: Command Injection via Attacker-Controlled DHCP Config

    CriticalCVSS 9.1No exploitEPSS 0%

    opnsense · opnsenseMay 13, 2026

  • CVE-2026-34578
    32Monitor

    OPNsense has an LDAP Injection via Unsanitized Username in Authentication

    HighCVSS 8.2No exploitEPSS 0%

    opnsense · opnsenseApr 9, 2026

  • CVE-2026-30868
    32Monitor

    Cross-Site Request Forgery (CSRF) in opnsense/core

    HighCVSS 8.1No exploitEPSS 0%

    opnsense · opnsenseMar 11, 2026

  • CVE-2023-39003
    30Monitor

    OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /t

    HighCVSS 7.5No exploitEPSS 0%

    opnsense · opnsenseAug 9, 2023

  • CVE-2023-39005
    30Monitor

    Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2.

    HighCVSS 7.5No exploitEPSS 0%

    opnsense · opnsenseAug 9, 2023

  • CVE-2019-11816
    29Monitor

    Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to es

    HighCVSS 7.2No exploitEPSS 3%

    opnsense · opnsenseMay 20, 2019

  • CVE-2023-38997
    28Monitor

    A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23

    HighCVSS 7.2No exploitEPSS 1%

    opnsense · opnsenseAug 9, 2023

  • CVE-2018-18958
    26Monitor

    OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.

    MediumCVSS 6.5No exploitEPSS 0%

    opnsense · opnsenseJun 17, 2019

  • CVE-2023-38999
    26Monitor

    A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition bef

    MediumCVSS 6.5No exploitEPSS 0%

    opnsense · opnsenseAug 9, 2023

  • CVE-2026-44195
    26Monitor

    OPNsense: Authentication lockout bypass

    MediumCVSS 6.5No exploitEPSS 0%

    opnsense · opnsenseMay 13, 2026

  • CVE-2020-23015
    25Monitor

    An open redirect issue was discovered in OPNsense through 20.1.5.

    MediumCVSS 6.1Proof of conceptEPSS 2%

    opnsense · opnsenseMay 3, 2021

  • CVE-2021-42770
    24Monitor

    A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication test

    MediumCVSS 6.1No exploitEPSS 1%

    opnsense · opnsenseNov 8, 2021

  • CVE-2023-39002
    24Monitor

    A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Busi

    MediumCVSS 6.1Proof of conceptEPSS 1%

    opnsense · opnsenseAug 9, 2023

  • CVE-2023-38998
    24Monitor

    An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect

    MediumCVSS 6.1No exploitEPSS 0%

    opnsense · opnsenseAug 9, 2023

  • CVE-2023-39000
    24Monitor

    A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 an

    MediumCVSS 6.1No exploitEPSS 0%

    opnsense · opnsenseAug 9, 2023

  • CVE-2023-44275
    21Monitor

    OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.

    MediumCVSS 5.4No exploitEPSS 0%

    opnsense · opnsenseSep 28, 2023

  • CVE-2023-44276
    21Monitor

    OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.

    MediumCVSS 5.4No exploitEPSS 0%

    opnsense · opnsenseSep 28, 2023