CVE-2026-58394Medium· 5.2▾ SunlitOPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.
core < 26.1.11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-58391Medium· 5.4OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
CVE-2026-58392Medium· 5.4OPNsense: Stored XSS in Services: NTP GPS
CVE-2026-58395Medium· 4.3OPNsense: XPath injection in MVC safe-delete
CVE-2026-58390High· 8.0OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
CVE-2026-57155Critical· 9.9OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
CVE-2026-108725Medium· 5.4Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions