Servers and applications

CVE-2023-39000

A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path.

Severity: Medium 6.1
Published: 9 Aug 2023
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 23.7
Sources: NVD

Affected software

Software	Affected versions
OPNsenseServers and applications · `cpe:a:opnsense:opnsense`	Every version before 23.7

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2023-39000
CVE.org https://www.cve.org/CVERecord?id=CVE-2023-39000