GCVE - cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*

part: a version: * update: *

Vendor	Pfsense (`16119953-645e-5c83-888a-eeb9b3a567ca`)
Product	Pfsense (`9a2d153d-225b-5e7e-b5c7-b1e06bfbde2d`)
Edition	*
Language	*
Software edition	community
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/pfsense/pfsense`	purl2cpe	2026-06-01 10:14:57.737765

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-34178`	vulnerable	2026-06-08 07:19:02.749849	Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. Published: 2025-09-09T20:23:44.475Z Updated: 2026-07-14T22:25:52.398Z Open on db.gcve.eu Reference links https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 https://redmine.pfsense.org/issues/16414 https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-package-stored-xss	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-34177`	vulnerable	2026-06-08 07:19:02.749475	Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. Published: 2025-09-09T20:19:09.928Z Updated: 2026-07-14T22:25:51.705Z Open on db.gcve.eu Reference links https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 https://redmine.pfsense.org/issues/16414 https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-stored-xss	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-34176`	vulnerable	2026-06-08 07:19:02.749070	Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. Published: 2025-09-09T20:14:37.899Z Updated: 2026-07-14T22:25:51.016Z Open on db.gcve.eu Reference links https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 https://redmine.pfsense.org/issues/16414 https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-directory-traversal-information-disclosure	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-34175`	vulnerable	2026-06-08 07:19:02.748614	Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated. Published: 2025-09-09T20:09:50.289Z Updated: 2026-07-14T22:25:50.307Z Open on db.gcve.eu Reference links https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 https://redmine.pfsense.org/issues/16414 https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-reflected-xss	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-34174`	vulnerable	2026-06-08 07:19:02.747302	Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions. Published: 2025-09-09T20:02:05.701Z Updated: 2025-11-20T12:23:37.606Z Open on db.gcve.eu Reference links https://github.com/pfsense/FreeBSD-ports/commit/9e412edf62113303c36c7f7d5a48b0a3fb0be893 https://redmine.pfsense.org/issues/16413 https://www.vulncheck.com/advisories/netgate-pf-sense-ce-status-traffic-totals-stored-xss	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-34173`	vulnerable	2026-06-08 07:19:02.745576	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-34172`	vulnerable	2026-06-08 07:19:02.744052	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-20729`	vulnerable	2026-06-08 05:29:10.431629	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10709`	vulnerable	2026-06-08 05:07:25.613561	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.