Show filters
21 Total Results
Displaying 11-20 of 21
Sort by:
Attacker Value
Unknown
CVE-2022-23993
Disclosure Date: January 26, 2022 (last updated October 07, 2023)
/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS.
0
Attacker Value
Unknown
CVE-2020-26693
Disclosure Date: June 01, 2021 (last updated February 22, 2025)
A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts via exploitation of the load_balancer_monitor.php function.
0
Attacker Value
Unknown
CVE-2021-27933
Disclosure Date: April 28, 2021 (last updated February 22, 2025)
pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.
0
Attacker Value
Unknown
CVE-2019-18667
Disclosure Date: November 02, 2019 (last updated November 27, 2024)
/usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser.
0
Attacker Value
Unknown
CVE-2016-10709
Disclosure Date: January 22, 2018 (last updated November 26, 2024)
pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.
0
Attacker Value
Unknown
CVE-2014-4694
Disclosure Date: July 02, 2014 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in suricata_select_alias.php in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via unspecified variables.
0
Attacker Value
Unknown
CVE-2014-4693
Disclosure Date: July 02, 2014 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the eng parameter to snort_import_aliases.php or (2) unspecified variables to snort_select_alias.php.
0
Attacker Value
Unknown
CVE-2014-4695
Disclosure Date: July 02, 2014 (last updated October 05, 2023)
Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to snort_rules_flowbits.php or (2) the returl parameter to snort_select_alias.php.
0
Attacker Value
Unknown
CVE-2014-4696
Disclosure Date: July 02, 2014 (last updated October 05, 2023)
Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to suricata_rules_flowbits.php or (2) the returl parameter to suricata_select_alias.php.
0
Attacker Value
Unknown
CVE-2011-5047
Disclosure Date: January 03, 2012 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in status_rrd_graph.php in pfSense before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the style parameter.
0
