Pfsense Ce
Approved changes feed: RSS · Atom
cpe:2.3:a:netgate:pfsense_ce:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Netgate (42bc912c-274f-5f68-8e52-e5d60c7dbf39) |
|---|---|
| Product | Pfsense Ce (e381ffea-5070-53e3-8af6-6fd88aae3cd6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-34178 |
vulnerable | 2026-06-08 07:19:02.749790 |
Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting
In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.
Published: 2025-09-09T20:23:44.475Z
Updated: 2026-07-14T22:25:52.398Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34177 |
vulnerable | 2026-06-08 07:19:02.749408 |
Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting
In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.
Published: 2025-09-09T20:19:09.928Z
Updated: 2026-07-14T22:25:51.705Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34176 |
vulnerable | 2026-06-08 07:19:02.749010 |
Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure
In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.
Published: 2025-09-09T20:14:37.899Z
Updated: 2026-07-14T22:25:51.016Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34175 |
vulnerable | 2026-06-08 07:19:02.747683 |
Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting
In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated.
Published: 2025-09-09T20:09:50.289Z
Updated: 2026-07-14T22:25:50.307Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34174 |
vulnerable | 2026-06-08 07:19:02.746288 |
Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting
In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.
Published: 2025-09-09T20:02:05.701Z
Updated: 2025-11-20T12:23:37.606Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34173 |
vulnerable | 2026-06-08 07:19:02.744627 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34172 |
vulnerable | 2026-06-08 07:19:02.742685 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-57273 |
vulnerable | 2026-06-08 06:56:13.467957 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-54780 |
vulnerable | 2026-06-08 06:54:16.815877 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-54779 |
vulnerable | 2026-06-08 06:54:16.814061 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48795 |
vulnerable | 2026-06-08 06:14:28.162512 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.