Netgate / Pfsense
49 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2025-12490 | Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability | HIGH | 8.8 | Nov 6, 2025 |
| CVE-2025-53392 | In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE… | MEDIUM | 6.5 | Jun 28, 2025 |
| CVE-2024-46538 | A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… | CRITICAL | 9.3 | Oct 22, 2024 |
| CVE-2023-48123 | An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the pa… | HIGH | 8.8 | Dec 6, 2023 |
| CVE-2023-42327 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.ph… | MEDIUM | 5.4 | Nov 14, 2023 |
| CVE-2023-42326 | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_… | HIGH | 8.8 | Nov 14, 2023 |
| CVE-2023-42325 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dyn… | MEDIUM | 5.4 | Nov 14, 2023 |
| CVE-2020-21487 | Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field… | CRITICAL | 9.6 | Apr 4, 2023 |
| CVE-2023-27253 | A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via… | HIGH | 8.8 | Mar 17, 2023 |
| CVE-2022-29273 | pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters. | MEDIUM | 6.1 | Feb 22, 2023 |
| CVE-2020-21219 | Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code v… | MEDIUM | 6.1 | Dec 15, 2022 |
| CVE-2022-26019 | Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 2… | HIGH | 8.8 | Mar 31, 2022 |
| CVE-2022-24299 | Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to… | HIGH | 8.8 | Mar 31, 2022 |
| CVE-2020-19201 | A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate pfSense version 2.4.… | MEDIUM | 5.4 | Jul 12, 2021 |
| CVE-2020-19203 | An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on v… | MEDIUM | 5.4 | Jul 12, 2021 |
| CVE-2020-10797 | An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing… | MEDIUM | 6.1 | Apr 29, 2020 |
| CVE-2020-11457 | pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user. | MEDIUM | 5.4 | Apr 1, 2020 |
| CVE-2019-16667 | diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csr… | HIGH | 8.8 | Sep 26, 2019 |
| CVE-2019-16914 | An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac parameters are displayed without sanitizati… | MEDIUM | 6.1 | Sep 26, 2019 |
| CVE-2019-16915 | An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without sanitization (e.g., a bas… | CRITICAL | 9.8 | Sep 26, 2019 |
| CVE-2019-16701 | pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters… | HIGH | 8.8 | Sep 25, 2019 |
| CVE-2019-12949 | In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can lever… | MEDIUM | 6.1 | Jun 25, 2019 |
| CVE-2019-12585 | Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php. | CRITICAL | 9.8 | Jun 3, 2019 |
| CVE-2019-12584 | Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php. | MEDIUM | 6.1 | Jun 3, 2019 |
| CVE-2019-12347 | In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php acti… | MEDIUM | 6.1 | May 29, 2019 |
Showing 1 to 25 of 49 CVEs