{"id":"CVE-2025-34182","title":"In Deciso OPNsense before 25.7.4, when creating an \"Interfaces: Devices: Point-to-Point\" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings","summary":"In Deciso OPNsense before 25.7.4, when creating an \"Interfaces: Devices: Point-to-Point\" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings. This value is directly displayed when visiting the page…","severity":"none","cwe":["CWE-79"],"published":"2025-10-01","updated":"2026-10-12","sourceUpdated":"2026-10-12T15:10:00.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-34182","references":[{"url":"https://docs.opnsense.org/releases/CE_25.7.html#september-30-2025","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/decisio-opnsense-stored-xss","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00327,"epssPercentile":0.23938,"ingestedAt":"2026-10-12T15:55:08.062Z","slug":"CVE-2025-34182","body":"## Overview\n\nIn Deciso OPNsense before 25.7.4, when creating an \"Interfaces: Devices: Point-to-Point\" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings. This value is directly displayed when visiting the page/interfaces_assign.php, which can result in stored cross-site scripting. The attacker must be authenticated with at-least \"Interfaces: PPPs: Edit\" permission. This vulnerability has been addressed by the vendor in the product release notes as \"ui: legacy_html_escape_form_data() was not escaping keys only data elements.\"\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}